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1 PROCEE D NGS 


2 ERK: United States District Court is now in 
3 session. 


4 THE COURT: We're waiting for one juror is the 


5 Situation. So I am not prepared to rule on this flurry of 


6 papers that came in, and I'm not going to right now. I don't 
7 even understand it. Okay, let's start from basics. What is 


8 Exhibit -- it's on the front page -- 267? 


9 MR. KOSTO: Exhibit 267, your Honor, is an advisory 


08:54 10 record from Cogent Corporation. It's in evidence. Cogent was 


ala the Internet service provider to the datacenter in Boston. 


12 THE COURT: So when I asked for exhibits, I mean, it 


13 wasn't such a mystery. It's within the first three, four lines 


14 of your motion. So I don't have all the exhibits. Where are 


15] they? 


16 MR. FRANK: We can give your Honor a copy of 


17 Exhibit 267. 


18 THE COURT: Yes, I need exhibits. But let's 


19 this Shah woman, was she one of the authors of one of 


08:54 20 e-mails or exhibits? 


21 MR. KOSTO: She sent the email, yes. 


22 THE COURT: So why isn't it appropriate just to limit 


23 her to the fact that she was the author of that email 


24 business records purposes, instead of this long, comp] 


25 unintelligible 302? Why don't I -- if there's a chall 
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alt the chain of business records -—- 


2 MR. FRANK: There isn't, your Honor. 


Si THE COURT: -—- the reliability of them, I think it's 


4 fair game for the government to put someone on to verify the 


5 business record chain, but there's so much more that you're 


6 asking to be put in, is my concern. And so I don't know where 


7 to go with this. I'm really just starting to digest it all, 


8 and I'm not prepared to rule before court today. 


L£ 


9 When were you thinking of putting this person on? 


08:55 10 MR. KOSTO: After Special Agent Hitchcock or after Ms. 
11 Yanochko. The hope would be to get her on and off so she can 
12 return to North Carolina. 


13 THE COURT: You popped it on me at the end of trial 


14 Friday. I didn't even know who she was. I thought she was 


LS just going to be a business record chain-of-custody person, 


16 which I thought was fair game because that is being challenged. 


Ly But it's so much more. It's so much more. 


18 MR. FRANK: We anticipate her testimony being about 


19 ten minutes. She's going to testify -- 
08:55 20 THE COURT: But they have to do their thing. 


21 MR. FRANK: Sure, that's true, but —- 


22 THE COURT: They need to talk to their expert. 


£ 


for, you 


23 mean, this is just complicated. And I keep asking 


24 know, all the different -- I was hoping for a, and I'm sure 


25 jury will need -- 
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1 MR. FRANK: We're prepared to do that this morning, to 


2 review with the chalk that I used on Thursday -- 
3 THE COURT: The numbers and where they go, and why is 


4 this even necessary? They're going to attack the Micfo files 


5 because it was criminally convicted. I understand that. 


6 That's been their position all along. I think the government 


7 has a right, and it's not prejudicial, just to put in a chain 


8 of custody. But that's different than all that's in here. So 


9 let's see if we can work something out, and I'm just not —-- 


08:56 10 whenever anyone says, "Rush, rush, rush, you need to rule," I 


11 put the skids on, I put the brakes on, because I want to make 


12 sure I understand it. So I'm not prepared to rule on that. 


13 Is there anything else? 
14 MR. KOSTO: Not from the government, your Honor. 


15 THE COURT: And can I have her email? Where is her 


16 Is that 267? 


LS) MR. KOSTO: Yes. I'll email it to her righ 


18 MR. FRANK: We might have a paper copy of i 


19 THE COURT: What might solve some of this problem and 


08:57 20 my ability to deal with things is, usually I get a courtesy 


21 copy of all the exhibits, and I haven't been doing that because 


22 there are so many, but it would be useful if -- do you have 


£ 


23 physical paper copies o 


everything? 


24 ‘ EMTSEV: We do. 


25 URT: So I'm the only one who doesn't, so it 
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ac would be useful to have that, and then I could have maybe made 


2 more headway this morning. 


3 Okay, we'll wait till the last juror comes. 


4 MR. FERNICH: Your Honor has made plenty of headway. 


5 You understand it. 


6 THE COURT: From reading. 


7 MR. FERNICH: You've got it. 


8 MR. FRANK: My intention, your Honor, was to review 


9 IP addresses and put them on the chalk with the special 


08:57 10 in about five minutes. Thank you, your Honor. 
11 THE COURT: Good idea. 


12 MR. FRANK: We'll also address the juror question that 


14 THE COURT: What was that again? 


15 MR. FRANK: The juror had a question about whether 


16 addresses could be traced to individuals by name. 


17 THE COURT: Oh, yes, so that's a fair question. 


18 used to run into that in the child porn cases. It's confusing, 


19 not that this is, but, you know, what exactly does the IP 


08:58 20 address denote? 


21 Okay, there it is. Thank you. Perfect. I'm just 


22 going to sit and skim it until the first juror comes in. How 


23 long do you think your witness will be today on direct? 


24 MR. FRANK: I hope to do it in under 45 minutes. He's 


25 mostly reading the Threema chats into evidence. 
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1 COURT: And then how long -- you may go fora 


3 MR. NEMTSEV: Maybe for a while. I hope not to go 
4 more than an hour anda half, your Honor. 

5 THE COURT: So who's next? 

6 MR. KOSTO: Ms. Yanochko or Ms. Shah. 


7 COURT: Both what? 


8 . KOSTO: Both short witnesses. 


9 COURT: Yanochko is who? 


08:58 10 MR. KOSTO: Ms. Yanochko is she prepared summary 


11 She's a financial investigator from our office. 


12 THE COURT: Yes. She's going to be the one who's next 


13 because I'm going to have to read this, but right now let me 
14 take a look at 267. 

15 MR. KOSTO: Thank you, your Honor. 

16 (A recess was taken, 8:58 a.m.) 

17 (Resumed, 9:05 a.m.) 


18 THE COURT: We have the last juror. 


19 THE CLERK: The agents and the interpreters are still 


09:06 20 oath. 


21 THE COURT: To the extent just hold on one second, 


22 Are we okay? 


23 To the extent I just read Exhibit 267, there is an 


24 from Ms. Shah that's part of the chain of custody. 


25 her to verify it was her email and what she was doing, 
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i but that's it. 
2 MR. KOSTO: That's what we proposed to introduce. 


3 THE COURT: Well, no, that's not what the 302 says. 


4 The 302 is like, you know, I should be a computer science 


5 major. So, anyway, it's just you had wanted some notice 


6 beforehand, so I'm likely to limit it to the chain of custody. 


7 MR. NEMTSEV: We don't challenge the email or the 


8 chain of custody. It's in evidence. 


9 THE COURT: I know, but they can put in their case. 


09:06 10 One thing that the government's brief flagged -- and 


1] indeed I've talked to several of my colleagues about this -- 


12 it's highly unusual to send venue to a jury. It's been hard to 


13 find any of my colleagues who have actually done it. I'm not 


14 saying never. I'm just saying it's rare, so I'm not finding 


15 much guidance in my colleagues' experiences on doing this. You 


16 know, we talk to each other about it. Just I don't know if any 


LS) of you have done that before. You did in Varsity Blues? Is 


18 that it? 


19 MR. FRANK: We did. It wasn't an issue quite the way 


09:07 20 it is here, but I did find that Judge O'Toole found that 


21 because the evidence was reliable, it did not need to go to the 


22 jury. 


23 THE COURT: Well, here it's contested, so I'm going to 


24 allow it to go to the jury. But I'm just saying, it's not such 


25 a —-- and that case going to the Supremes seems to have it. 
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al MR. FERNICH: Your Honor, at home, it's standard 


2 practice, you know, and that's why there's a Sand instruction, 


3 so I've never heard of it not going to the jury. 


4 THE COURT: I know, it's the first time you sort of 


is raised the -- can I use the word "balloon" after the 


6 weekend? -—- but, anyway, the first time you raised the balloon. 


7 Anyway, at this point I'm trending towards allowing it to go to 


8 the jury. So, anyway, okay, let's get the jury. 


9 Do you have to hit the button again? 


09:08 10 THE CLERK: Yes. It dies out. 


11 (Pause.) 


12 THE COURT: What's the issue? Wouldn't you know, 


13 got a notice today the Health Unit is closed. 


14 (Discussion between the Court and Clerk.) 


iS) THE COURT: You know, while we're waiting for them, do 
16 you have a sense of timing still as to when we need to do that 
17 jury charge? When do you think it's okay to -- 


18 MR. FRANK: Wednesday might be good. 


19 COURT: When? 
09:10 20 . FRANK: Wednesday. 


21 COURT: I could go to the jury on Wednesday? 


22 MR. FRANK: No. Wednesday would be a good time for 
23 the charge conference. 
24 THE COURT: Okay. So maybe it would go to the jury on 


25 Friday maybe? 
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1 NEMTSEV: think that's right, that's reasonable, if 


2 we close on Friday. 


3 THE COURT: All right, so I can at least do the charge 


4 ference on Wednesday. 


is MR. NEMTSEV: Yes. 


6 THE COURT: Fair enough. 


7 One of the jurors says she has a doctor's appointment 


8 Monday afternoon; does she need to postpone? It's right on the 


9 edge. 


09:11 10 . FE CH: A week from today? 
de. : Yes. 
12 ] : Juror Number 1. 


13 : Next week, right? 


14 I : I don't know. He just handed it to me 


16 THE COURT: So we'll let them go, if worst comes to 


Ly worst. We'll break for half a day —- 


18 THE CLERK: All rise for the jury. 


19 (Jury enters the courtroom.) 
09:11 20 THE COURT: Good morning. 
21 THE JURY: Good morning. 
22 THE COURT: There we go. We've got everybody. Once 


23 again, the most amazing jury. You came on ti . I hope you 


24 got home well on Friday. It was cold as could be for 24 hours, 


25 but then today is beautiful. Did anyone speak about the case, 


09:12 10 


09:12 20 


21 


22 


23 


24 


25 
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see anything in the press, do any social media research, anyone 


try and communicate with you? I find the jury has comp] 


lied. 


You know, just after I got the email this morning that 


£ 


for anything. 


the Health Unit was closed today, Maryellen managed to have a 


treasure trove of Band-Aids, so that's why I can count on her 


So, anyway, why don't you be seated, and I hope you 


all have your notebooks. We're going to go back to the agent. 


We did get -- oh, my God, I forget his name -—- the Saxo man 


back on the plane, so thank you for coming in on Friday. 


All right, go ahead. 


MR. FRANK: Thank you, your Honor. 


DAVID HITCHCOCK 


having been previously duly sworn, was examined and testified 


£ 


further as follows: 


CONTINUED DIRECT EXAMINATION BY MR. FRANK: 


Good morning, again, Special Agent. 


Good morning. 


It's been a while. Special Agent, when we broke last 


Thursday, we received a juror question that I'm going to pose 


to you now. The question is this: 


"For every IP address in the world, can you tell who the 


person or persons are who are utilizing that particul 


ak 


IP 


address? For example, for my personal laptop, would that 


address have my name associated to it?" 
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1 A. So with an IP address, going back to an ISP where they 


2 maintain records of who their customers are, then on a specifi 


3 day at a specific time, that IP address would be associated 


4 with an individual, so there would be attribution in that case. 


5 In other cases, say the use of a VPN, a virtual private 


6 network, or otherwise an ISP that does not maintain records or 


7 does not disclose the subscriber of a given IP address at a 


£ 


8 specific date and time, then we would not have a name 


9 associated with it. So in that case, what we would do is, we 


09:14 10 would see where 


11 : IMTSEV: Objection, your Honor. 


12 JRT: Excuse me? 


13 : IMTSEV: object to what "we would do." 


14 THE COURT: Yes, sustained. 


15 Q. Well, what would you do if you did not have a name 


16 associated with an IP address? 


17 MR. NEMTSEV: Objection. 


18 THE COURT: Overruled. 


19 As We would investigate where that IP address was used on and 


09:14 20 around that specific date and time to include institutions 


21 where you would have a real person's identity and name 


22 associated with an IP address. So a financial institution 


23 would keep records like that. Certain social media and email 
24 accounts, Apple accounts would maintain records that go back to 


25 a real person. 
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al MR. FERNICH: I object to this, for the record, to the 


2 procedure and under 702. 


3 THE COURT: Well, I think, yes, that was far beyond 


4 the question, so I'll strike that. 


bs) Q. Okay, I want to now —- we went through a lot of IP 


6 addresses quite quickly when you were last here on Thursday. 


7 want to go back to those IP addresses and give the jurors an 


8 opportunity, if they wish, to write those down and just quickly 


9 review how they were used. So let me just -—- we used this 
09:15 10 chalk. Do you recall testifying about this chalk, Special 


11 Agent? 


13 : Okay. So I believe you testified you received some domain 


14 from Toppan Merrill. Do you recall that testimony? 
15 . Yes. 

16 : Okay. What did you do with those? 

17 : We went to Namecheap and inquired about those domains. 


18 ‘ And what did you learn from Namecheap? 


19 : That the accounts associated with the domain names were 


09:16 20 subscribed to with "inbox.lv" email accounts, as well as there 


21 was at least one of three common IP addresses used to subscribe 


22 to the account. 


23 Q. What were the three common IP addresses? 


24 A. The first IP began with 89.238. 


25 Q. Okay. So I'll write that down. I don't have very good 
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1 handwriting, but I'll do my best. 
2 A. We lost the visual. 
3 THE COURT: Did you lose your screen? 


4 THE WITNESS: Yes, ma'am. 


5 THE CLERK: I knew that was going to happen. 
6 why. 


a THE COURT: Have you got your screens? Yes, they do. 


8 I just the witness screen. 


9 THE CLERK: It's when I toggle back and forth, it's 


09:16 10 a problem with the witness stand. No one seems to know 


da. ‘ It's back. 


12 THE WITNESS: Thank you, ma'am. 

13 : So that was one of the three, 89.238.166.235? 
14 : Yes. 

15 ‘ What was another? 

16 : 64.42. 

17 ‘ Was that the second, 64.42.179.59? 


18 : Yes. 


19 : Okay. And what was the third? 


09:17 20 3 It was a 199.249. 


21 : Was that the third IP addresses, Special Agent? 
22 : Yes. Yes, it was. 


23 THE COURT: IP address for what? 


24 THE WITNESS: These were three common IP addresses 


25 wherein each of the accounts associated with the domains that 
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1 TM provided, at least one of these three IPS appears associated 


2 with each of those accounts. So the domains were bought by way 


3 of Namecheap. Namecheap maintains IP addresses of who bought 


4 them from what IP address at what date and time; and then, if 


5 you go into the account again to view or manipulate that 


6 account, they'll log those IP addresses and —- 


a THE COURT: So these aren't Toppan Merrill's? 


8 THE WITNESS: No. These are the IPS associated with 


9 the individuals, or a group of individuals, that purchased the 


09:18 10 domain names that were used in the intrusion into Toppan 


Ad. Merrill. 


12 COURT: So these are the alleged intruder's domain 


14 THE WITNESS: Yes. 


15 THE COURT: All right. 


16 Q. And all of those accounts were from an inbox.lv email 
Af address? They were all -—- 


18 A. That's correct. 


19 Q. When you had these IP addresses —- 


09:18 20 THE COURT: Can I be clear about this. You're not 


21 getting this chart. These look like -—- you know, as I said, 


22 it's gquaintly called a "chalk" because we used to have 


23 blackboards. So I would suggest, because it's impossible to 


24 memorize these numbers, you either write it down, but you're 


25 not getting this chalk. 
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i Q. Special Agent, once you had the information that all of 


2 the domains were associated with an inbox.lv email address and 


3 with one or more of these IP addresses, what did you do then? 


4 : We identified that these domains were hosted at two 


5 different hosting providers, Vultr and DigitalOcean, which 


6 you'll see to the right. 


7 Q. Okay. And what did you do then? 


8 A. We asked about the subscriber information for those 


9 accounts, and we identified that they were associated with 


09:19 10 99Stack and BitLaunch, who are third-party resellers 
Li THE COURT: Wait a minute. Slow down. So all three 


12 domain names, how were they associated with Vultr and 


13 DigitalOcean? 


14 Q. Well, there were more than three domain names, correct, 


LS Special Agent? 
16 A. Yes, and so —— 
A} THE COURT: Excuse me. We just heard about these 


18 three domain names, so let's just cabin what we're talking 


19 about. With these three domain names, how did they relate to 


09:19 20 Vultr and DigitalOcean? 


21 THE WITNESS: Well, I'll take one step back. So these 


22 three IP addresses were associated with multiple domain names 


23 that TM provided to the FBI. 


24 Q. So TM found multiple domain names associated with the 


25 intrusion on its system? 


Case 1:21-cr-10104-PBS Document 214 Filed 02/21/23 Page 18 of 161 


1 . Yes. 
2 ‘ Those domain names came back to Namecheap? 
i : Yes. 


4 e Those domain names were all associated with one of these 


5 three -—- one or more of these three IP addresses? 
6 A. Correct. 


7 O- And with an inbox.lv email address? 


8 A. Correct. Common use of inbox.lv to subscribe to the 


9 Namecheap accounts used to purchase the domain names that were 
09:20 10 used in the compromise. 


11 Q. Once you had that information, you went to Vultr and 


12 DigitalOcean? 


13 A. Yes. 
14 Q. And once you had that information, you went to 99Stack and 


is) BitLaunch? 


16 A. Correct. Those domain names were hosted at 99Stack and 


Ly BitLaunch. 


18 Q. Got it. So multiple domain names, but only these three 


19 common IP addresses? 
09:20 20 A. Correct. 
21 Q. Got it. And when you went to 99Stack and BitLaunch, what 


22 did you learn? 


23 A. We learned that two of those same IP addresses that we 


24 observed in the Namecheap records were used to access both 


25 99Stack and BitLaunch. 
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al. : Which of the two? 


2 : That was the 89.238 and the 64.42. 
3 ‘ And was there anything else that you learned from 99Stack 


4 BitLaunch? 


5 “ Yes. The account at each, 99Stack and BitLaunch, was in 


6 the name of an Andrea Neumann with an email address 


7 neumann@dr.com for each, the 99Stack account and the BitLaunch 


8 account. 


9 Q. I see. So all of those domain names were hosted on 


09:22 10 computers, computer servers associated with these companies? 
11 A. Yes. 


12 Q. And all were associated with a single registrant, Andrea 


13 Neumann? 


14 A. Correct, with a unique neumann@dr.com email account. 


15 Q. And that account had been accessed by two of those same 
16 addresses? 
Ay A. Correct. 


18 Q. What did you do then? 


19 A. We had new information at this point, the neumann@dr.com 


09:22 20 email. We went back to Namecheap and inquired about that email 
21 account and identified a new Namecheap account. 


22 QO. In the name? 


23 A. In the name of Andrea Neumann with the neumann@dr.com 
24 email account. 


25 ©. So Neumann had a separate account at Namecheap in the name 
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al Neumann? 
2 : Correct. 


3 ‘ And what did you learn about that account? 


pl ag 


4 : That it was paid for by way of Bitcoin, and that it was 


5 also accessed by the same 89.238 IP address that we had already 
6 seen. 
7 Q. So that Andrea Neumann account was also associated with 


8 the 89 IP address? 


9 A. Correct. 


09:23 10 Q. That's my pathetic attempt at an arrow. Okay. So once 


11 you had that information, you mentioned that you also had 


12 Bitcoin information? 


13 A. Yes. The Namecheap domains associated with the Neumann 


£ 


14 account were paid 


or by way of Bitcoin. 


15 OQ. What did you learn about that? 


16 A. There was a third-party payment processor called BitPay 


LS} that we see at the bottom of the chart. BitPay was used to 


18 facilitate that Bitcoin payment. 


19 Q. What did you learn from BitPay? 


09:23 20 A. That the payment for the Andrea Neumann, Neumann@dr.com 


21 email account was -- 


22 : Did you get those records from BitPay? 


23 : Yes. 


24 : Did you get any other records from BitPay? 


25 . We also got records for a Wan Connie account. 
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ac On Okay. Now, we have not heard about the Wan Connie 


2 account. Do you know if anyone else is going to be testifying 


3 about 1 Wan Connie account? 
4 A. . Mr. Vincent Kenny. 


5 O- What did you learn about the Wan Connie account? 


6 A. The Wan Connie account was accessed by the M-13 89 
7 address ending in .42. 
8 : So the Wan Connie account came back to 89.107.124.42? 
9 : Yes. 

09:24 10 ; And that's M-13? 


Ad. ‘ Correct. 


12 ; Okay. Now we move to the second IP address. 
13 MR. FRANK: Ms. Molloy, could we please go back to the 


14 trial record. 


15 THE CLERK: Yes. Give me a minute, and then I want to 


16 make sure your screen works when I switch back because that's 


17 been a problem. Okay, I just switched over. 


18 MR. FRANK: Thank you. 


19 And, Ms. Lewis, could we have Exhibit 218 in evidence. 


09:25 20 : Special Agent, do you recall looking at Exhibit 218? Do 


21 have it on your screen? 
22 (Pause.) 


23 THE COURT: What's happening now? 


24 THE CLERK: His screen, as usual, when I toggle back 


25 forth with the doc camera, we lose the connection. So 


09:26 10 


09:27 20 


21 


22 


23 


24 


25 
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6-22 


we're going to have to just use the flat screen for now. This 


is ongoing in this courtroom. We don't know why. 


Q. 


in 


Q. 


address, 


Special Agent, do you see that Exhibit 218 on the screen 


On the right-hand side of that screen is another IP 


front of you? 


from? 


A. 


Q. 


This 


So T™M 


185.228.19.147. Where did you get that IP address 


IP address came from TM. 


found evidence that this IP address had been used in 


the intrusion? 


Yes. 


And what did you learn about that IP address? 


That on January 29 —- 


address? 


A. 


ISP cal 


The 


Before you get to the specifics, who operated that 


Where did it come back to? 


185 


IP address was hosted here in the United States at 


Okay. 


Yes. 


led 


DediPath. 


And was it associated with a VPN? 


What was the VPN? 


So that's an AirVPN I 


Yes. 


Okay. 


Its subscriber was Ai 


And I believe you testified about obtaining a pen 
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A register? 
2 A. 


3 Q. That's like caller ID? 


4 THE COURT: So it was hosted at where? 


5 THE WITNESS: It was hosted here in the United States 


6 ISP DediPath. 


a HE COURT: How do you spell that? 


8 HE WITNESS: D-e-d-i-P-a-t-h. 


9 Q. And I believe we looked at I believe it was 


09:27 10 Exhibit 130. 


Li Ms. Lewis, can we look at 130. 
12 This is the DediPath record associated with that 


13 185.228.19.147 IP? 


14 . Correct. 


15 ; And what does it indicate about who the client is? 


16 : AirVPN in Italy. 


£ 


17 : And you testified on Thursday that you obtained a pen 


18 register on this IP address in January and February of 2020? 


19 A. 


09:28 20 Q. That's like caller II 


21 A. Correct. 


22 Q. Could we go back to Exhibit 218, please. What did you 


23 learn about the access to the 185 AirVPN IP through the pen 


24 register? 


25 A. On January 29, 2020, the M-13 89 IP ending in .42 accessed 
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alt this AirVPN IP at 4:59 Pacific time. 


2 Q. So the M-13 89 IP which we just saw on the chalk, that 


3 IP accessed the AirVPN IP on January 29 at 4:59 PST? 


4 . Correct. 


5 QO. And the AirVPN IP was associated with the unauthorized 


6 access on TM? 
7 A. Correct. 


8 Q. Okay. What else did you learn -- well, let me call up 


9 Exhibit 196A in evidence, please. 


09:29 10 And can we do that on the right, Ms. Lewis, with 218 


Ac. on the left? 


12 What did you learn about the use of the M-13 89 


13 A. The M-13 89 IP ending in .42 was used that same day, 


14 January 29, 2020, at 2:18. 


15 : Okay. Now, who used it on January 29, 2020? 


16 : Vladislav Klyushin. 
17 : And how did he use it? 


18 : He used it to access the Russian Standard Bank .ru account 


19 associated in this screenshot. 
09:29 20 ; And in the screenshot there's a time, 14:18? 
21 : Correct. 
22 ; What is 14:18 Moscow time in Pacific Standard Time? 


23 : 3:18 Pacific Time. 


24 : And how does 3:18 Pacific Time compare with the time that 


25 the 89 IP accessed the AirVPN IP? 
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al MR. FERNICH: Objection. 


2 THE COURT: Overruled. 
3 ; That is 1 hour and 41 minutes apart. 


4 ‘ So 1 hour and 41 minutes after Mr. Klyushin used the M-13 


5 IP to access his bank account, the M-13 89 IP was used to 


6 access the AirVPN IP? 


7 F Correct. 


8 : that AirVPN IP was found on TM's system? 


9 . ttributed to the intrusion activity. 


09:30 10 . Okay, one last IP address. Could we have Exhibit 221 in 


11 evidence, please. What is Exhibit 221? 


12 A. This is showing on May 9, 2018, at 12:44 Pacific daylight 


13 time, the 119.204.194.11 IP was used to update Ivan Ermakov's 


14 iTunes account. 
15 Q. Now, we looked at 221 on Thursday and it said "PST." Have 
16 you corrected the chalk, the exhibit? 


1] A. Correct. The time is the same hours and minutes, but it 


18 was a typo on the time zone. 


19 Q. Okay, so at 44 minutes after midnight PDT on May 9, 2018, 


09:31 20 van Ermakov used the IP 119.204.194.11 to update his iTunes 


21 account? 
22 A. Correct. 


23 or And the iTunes account was in whose name? 


24 A. van Ermakov's true name. 


25 Q. Could we now have on the right Exhibit 195A in evidence. 


Case 1:21-cr-10104-PBS Document 214 Filed 02/21/23 Page 26 of 161 


1 What is 195A? 


2 A. These are DFIN logs associated with a Julie Soma account 


3 showing on May 9 the 119 IP address accessing certain files. 


4 Q. So at 48 minutes after midnight Pacific Time on May 9, 


5 2018, how was the 119 IP used with respect to documents of 


6 Horizon Pharma PLC? 


7 A. It was used to download records associated with Horizon 
8 Pharma. 
9 : Using whose username? 

09:32 10 : Julie Soma. 


11 ‘ And how many minutes did that occur after Mr. Ermakov used 


12 exact same IP address to access his iTunes account? 


13 F Four minutes later. 


14 : Okay. And then there were other downloads in the minutes 


15 afterwards? 


16 A. Yes. 


17 Q. Thank you, Special Agent. You also testified on Thursday 


18 about a 104 IP address. Do you recall that testimony? 


19 A. 


09:33 20 Q. Could we have Exhibit 140 in evidence, please, and could 


21 we go to Page 5. 


22 Do you recall testifying about this invoice from Micf 


23 A. I do. 


24 O. And the date on this invoice is November 24, 2018. 


25 see that? 
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al ; Yes. 


2 : And the due date is December lst, 2018? 


3 F Yes. 


4 ‘ Directing your attention to the first entry, do you see an 


5 for an IP address 104.238.37.0/24? 


6 : Yes. 


. : And that refers to a block of IP addresses in that range? 


8 : Yes. 


9 : Okay. And where was that IP address, according to this 


09:33 10 invoice, hosted? 


11 : Boston, Massachusetts. 

12 ‘ Okay. And that's on Server 7? 

13 : Yes. 

14 : Okay. This invoice says "unpaid." Do you see that? 


15 : Yes. 


16 : And I believe you testified that you had reviewed 


17 documents indicating it had been paid? 


18 A. Yes. 


19 MR. FRANK: Could we have on the right, please, 


09:34 20 Exhibit 268, and I'd offer it. 


21 Exhibit 268 received in evidence.) 


22 : I u see Exhibit 268? 


23 


24 - Whose bank statement is this? 


25 . This is StackPath's. 
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1 Q. And StackPath was the entity that owned ITP address at 


2 this time? 


3 A. Correct. 


4 QO. Okay. And you can see that the address for StackPath in 
5 the bank statement is what? 
6 : 2021 McKinney Avenue. 


. : Okay. And how is StackPath related to Mudhook Market 


8 : It is a parent company of Mudhook Marketing, among ot 
9 VPN companies. 

09:34 10 Q. And Mudhook is also on McKinney Avenue in Dallas? 

11 A. 

12 Q. Okay. 


13 MR. FRANK: And could we go to Page 8 of the bank 


14 statement, please. Is that page 8? Can you go to Page 9, a 


15 little bit earlier. Let's try Page 6. No, one earlier. And 


16 one over. Oh, I'm sorry. There we go. 
17 Q. Okay. Special Agent, do you see there's an entry in the 


18 bank statement on December 2, 2018, for Micfo? 


19 A. I do. 


09:35 20 Q. What is the amount of the payment that StackPath made to 


21 Micfo on December 2, 2018? 

22 A. $1,010. 

23 Q. Okay. And how does that compare to the amount that it 
24 owed on the invoice on the left? 


25 A. The same. 
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i Q. Okay, could we go to Page 7 of the invoice on the left, 


2 and do you see there's another invoice to Mudhook Marketing 


3 dated December 4, 2018, regarding that same 104 IP address in 


4 Boston? 


5 A. Yes. 


6 MR. FRANK: And, Ms. Lewis, if you go to the next 


7 page, could we just look at the total for that invoice. 


8 Q. What's the total amount for that invoice? 
) A. $3,030. 


09:36 10 MR. FRANK: And could we advance, Ms. Lewis, on the 


11 right, to December 12. There we go. 
12 Q. And do you see that there's a payment to Micfo on 


13 December 12, 2018? 


14 A. 

15 Q. And how does that amount compare to the amount of the 
16 invoice? 

17 A. same. 


18 O. Thank you. 


19 MR. FRANK: Ms. Lewis, you can take that down. 
09:36 20 Q. Special Agent, before we broke on Thursday, you were 
21 testifying about messages you obtained that were sent on the 
22 Threema chat application. Do you recall that? 
23 A. Yes. 
24 THE COURT: Can we just back up for a minute. What's 


25 the 104 address? 
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1 THE WITNESS: This is the IP address that is 


2 associated with Boston, and it was used to access one of the 


3 two filing agents. 


4 THE COURT: One of the two —- 


is THE WITNESS: Filing agents, so to access the material 


6 nonpublic information at one of the two filing agents. 


7 THE COURT: Not the list you gave us? 


8 THE WITNESS: We were referring to the 119 


9 think that may be what you're -—- oh -- 


09:37 10 MR. FRANK: Give me one moment. 


11 THE WITNESS: I see. You're referring to the chalk. 


12 THE COURT: Yes. 


13 Q. Could we look at Exhibit 191 in evidence, please. What is 


14 Exhibit 191, Special Agent? 


15 A. These are records associated with the same Julie Soma 


16 account at DFIN where a 104 block of IPs were used to access 


17 material nonpublic information at DFIN by way of a Julie Soma 


18 account on October the 22nd and 23rd. 


19 Os And this is that same 104.238 block of IP addresses that 


09:38 20 we just looked at on the Micfo invoice? 
21 : Correct. 
22 : That was owned by StackPath? 
23 : Correct. 
24 : And you see that the first date of the download depicted 


25 on this exhibit is on October 22nd? 
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2 MR. FRANK: Can you go to the next page, Ms. Lewis. 


3 ‘ it continues later into October? 


5 : the next page. 
6 : into November. 
. : the next page. 


8 MR. FRANK: Is this the last page, Ms. Lewis? 


9 : So this is the last page, and you can see that the use of 


09:39 10 IP address continued to November 8, 2018? 


Li A. Yes. The use of this IP block, the 104.238.37 block of 


12 IPs that goes back to StackPath at Micfo in Boston, is 


13 represented here accessing the Julie Soma account between that 


14 October-November time period for these company names. 
LS Q. Okay. Okay, back to the Threema chat application. What 


16 is Threema? 


17 A. Threema is an encrypted chat application that can be used 


18 to communicate between one or more people, so at least two 


19 people are exchanging communications. 


09:39 20 Q. How does Threema compare to WhatsApp? 


21 A. It is very similar. WhatsApp uses a telephone number to 


22 distinguish who the counterparties are. Threema uses an 


23 alphanumeric string that is randomly created to be associated 


24 with each of the individuals, a random string. 


25 OQ. So it's more anonymous? 
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al A. Correct. 


2 O.. Are you able to identify who the individuals are who are 
3 associated with that alphanumeric string? 
4 A. 


5 Ox How do you do that? 


6 A. By review of the context and content of the communications 


7 and compare it to other data. You might have other 


8 communications where they might refer to that specific unique 


9 code, that alphanumeric code. 


09:40 10 O.. So in this case, where did you find an unencrypted version 


11 of this Threema chat? 


12 A. Nikolai Rumiantcev's Apple account. 


13 Q. And were you able to associate one of the alphanumeric 


14 strings to Nikolai Rumiantcev? 


15 A. 
16 Q. What else did you learn about the other alphanumeric 


17 strings? 


18 A. That one of the accounts was associated with Ivan Ermakov, 


19 and another account was associated with Vladislav Klyushin. 


09:41 20 Q. And how did you determine that? 


21 A. van Ermakov and Vladislav Klyushin shared a WhatsApp 


22 exchange where that unique random code associated with Threema 
23 was shared. So in a separate chat application, we see the 


24 Threema unigue secret code being exchanged at and around the 


25 same time that that unique code enters into a multiparty 
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ac communication inside Threema. In other words, you have to 


2 share your code with someone so they know who you are or they 

3 know to add you to a certain chat, and we saw it being shared 

4 in WhatsApp. 

5 OF Special Agent, we're going to call up an extract from that 


6 Exhibit 151. 151 was the WhatsApp chat between Mr. Klyushin 


i and Mr. Ermakov. Do you recall that? 
8 A. Yes. 


9 MR. FRANK: Can we have 151E, please, and I 


09:42 10 


11 (Exhibit 151E received in evidence.) 


12 ‘ Special Agent, what are we looking at on 151E? 


13 A. Vladislav Klyushin is transmitting to Ivan Ermakov via 


14 WhatsApp a unique alphanumeric code that is associated with a 
15 Threema account. 


16 Q. 2TE3DWWU? 


Ly A. Correct. 


18 Q. What is the date and time of this communication on 


19 WhatsApp? 


09:43 20 A. On May 13, 2019, at 3:20 p.m. Eastern. 


21 MR. FRANK: Ms. Lewis, could we now put this on the 


22 left, and on the right could we have Exhibit 46 -- oh, I'm 


23 sorry. That's Excel, so we can't do it side by side? Okay. 


24 Q. So this was May 13, 2019, at 3:20 p.m., do you see that, 


25 Fastern Time? 
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2 MR. FRANK: Okay, could we now have Exhibit 46, and 


3 [ ffer it. 


4 (Exhibit 46 received in evidence.) 


5 MR. FRANK: And, Ms. Lewis, if you could take us in 


6 Exhibit 46 to Line 2271. 


. Q. Why is this exhibit, Special Agent, in an Excel format? 


8 A. This was the way it was extracted from the Threema 


9 database. 


09:43 10 Q.. And you see that there are different the text entries 


11 are color-coded? Some are red, some are blue, some are black, 


12 I believe we'll see some that are green? 
13 : Correct. 


14 - Who color-coded it? 


15 . The FBI. 
16 ‘ And what do the colors represent? 


17 : The individuals who are communicating. 


18 ‘ Okay. So who is the individual that you identified in red 


09:44 20 ; van Ermakov. 


21 : Who is the individual in black text? 


22 2 Nikolai Rumiantcev, the owner of this Threema account. 


23 : Who's the individual whose text we'll see in green? 


24 : This is Vladislav Klyushin. 


25 i And then there's an individual in blue. Who's that? 
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al A. An unidentified individual. 


2 Q. Okay. So directing your attention to Line 2271, could you 


3 read, identifying the speakers, from 2271 to 2288. 


4 A. Ermakov 
5 THE COURT: Something just happened, so it's blurred 
6 and we can't read along. Do you know? 


7 MR. FRANK: Ts that better, your Honor? 


8 THE COURT: Can you blow it up a little bit? Good. 
9 Thank you. 


09:45 10 Q. Special Agent, could you begin at 2271. 


11 A. "Ermakov: Greetings! I created a group and added here 


12 another person. I invite to write and discuss all issues 


13 concerning trading and topics related to it here." 
14 Q. Continue. 


15 A. "An unidentified individual: Hi. OK. 


16 "Rumiantcev: Can you tell at least, in general, who is 


LS} third person? 


18 "Ermakov: This is my colleague. He is completely on top 


19 of the subject. You can trust him as you trust me, and if you 
09:45 20 want, you can check with Vlad. 
21 "Rumiantcev: Add Vlad to the chat. 


22 "Nikolai Rumiantcev: Should all issues be addressed 


23 there? 


24 Ermakov: Do you think he needs that? 


25 "Rumiantcev: Yes, quite often we need to explain him 
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1 something that we have already discussed in the chat. But this 


2 way he will be reading it on his own. 


3 "Ermakov: Yes, for working issues, I do not always have 


4 time and I'm not always available, so the colleague will be on 


5 peiee 


6 "Rumiantcev: One more question: Is the mailbox one for 


i everyone, or a group one needs to be created? 


8 "Ermakov: This way it will be easier. There is one email 


9 and it is sufficient for now. 
09:46 10 "Rumiantcev: OK. Will you add Vlad? 


11 Ermakov: Added. 


12 "Vlad: A good name. Greetings everybody." 


13 Q. Okay, and if we look at the time entry when Mr. Klyushin 


14 joins the chat, you can see, if we move up a few lines, 


15 Mr. Rumiantcev says, "OK. Will you add Vlad?" That's at 3:12 


16 p.m.? 
17 : Yes. 


18 : And Mr. Ermakov responds at 3:22 p.m. "Added"? 


19 : Yes. 

09:47 20 ; And do you recall that the time stamp on the WhatsApp chat 
21 the alphanumeric string was 3:20 p.m.? 
22 : Correct. 


23 : So that's two minutes before this entry? 


24 : Correct. 


25 : Thank you, Special Agent. And there are a few spots here 
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1 I should just note, like on line the one that's marked 2281 
2 where you see there's a prior communication, and then there's a 
3 response to that? 

4 A. 

5 O- What does that indicate, Special Agent? 


6 A. That's whenever an individual wants to reply, there may be 


. ten strings of chat, they want to reply to one of those ten 


8 lines uniquely, and they will reply to that one out of the ten 


9 lines, and it will be quoted -- 


09:48 10 Q. If the chat is going back and forth and there's multiple 


11 entries, this could reply to an earlier line in the chat? 


12 A. Correct, so it's clear what they're replying to. 


13 Q. Okay. I want to now back up to the very top of the 


14 Threema chat. Was the Threema chat ongoing by the time 


15 Mr. Klyushin joined on May 13? 


16 A. Yes. 


17 O. Okay. When is the date of the first entry of the Threema 


18 chat? 


19 ; October 30 of 2018. 


09:48 20 . And who's involved in the chat as of that date? 


21 F This is Rumiantcev and Ivan Ermakov. 


22 : Okay. And if we could move to Lines 155 to 158. The jury 


23 will have the entire Threema chat in evidence. I'm just going 


24 to be directing you to certain lines to read them for the 


25 record. If we go to 155, could you begin reading there until 


Case 1:21-cr-10104-PBS Document 214 Filed 02/21/23 Page 38 of 161 


1 Line 158. 


2 A. "Ermakov: Here's the situation. SSNC is a problem stock. 


3 Along with report they declared additional securities emission. 


4 So far there is no information on the price numbers and this is 


5 not good. Close them in first place, for they most likely will 
6 go down." 


7 Q. And what is the date of that communication? 


8 ‘ This is November 1, 2018. 


9 : Could we advance to Line 226, please. And I'd ask you to 


09:49 10 from Lines 226 to 234 beginning with the date. 


Li : November the 2nd, 2018. 


12 Ermakov: Can you summarize results today? 
13 "Rumiantcev: What does it mean? What is the earning? 


14 Ermakov: Yes. 


15 "Nikolai Rumiantcev: I make a report for Vlad every 


16 trading day, and the next trading day after 15, when reports 


Ly from the broker come. 


18 Ermakov: I got it. Can you cc it to me, as well?! 


19 "Rumiantcev: I will send information on trades." 


09:50 20 Q. Thank you, Special Agent. And I neglected to ask you this 


21 earlier: These communications were originally in Russian, 


22 correct? 


23 A. Yes. The FBI translated what I am reading here. 
24 Q. Thank you. Could we move ahead to Line 259, please. And 


25 what is the date of Line 259? 
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al . This is November the 8th of 2018. 


2 ‘ Could you read from 259 to 270. 


3 ; "Rumiantcev: What are you thinking to do with Roku? 


4 Ermakov: So far there is no reason for such a drastic 


5 fall. I will put together results from trading and will 


6 decide. The same with TRIP. 


7 "Nikolai Rumiantcev: We acted too hastily about TDD. 


8 Ermakov: This was not us who were hasty. It is market 


9 is acting strangely. Linked to a NASDAQ article about why 


09:51 10 stock was slammed Thursday. 


11 "Rumiantcev: I've read it. Should we wait for comeback? 


£ 


12 Ermakov: I think so. Too big of a loss otherwise. 


13 Let's see what's going to be happening today. The market 

14 Situation is complicated. Whatever should be going up, going 
15 down, and vice versa. 

16 "Rumiantcev: Perhaps we should work with stops when 


17 opening new positions? 


18 "Ermakov: We are talking about it. Describe how you see 


19 it. I don't quite understand how to work with them on large 


09:52 20 volumes." 
21 Q. Thank you, Special Agent. 


22 Could we move, Ms. Lewis, to Line 375. 


23 Special Agent, could you read from Line 375 to Line 382 
24 and beginning with the date. 


25 A. November 19, 2018. 
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al "Nikolai Rumiantcev: Greetings. There are two 


2 corrections about the inquiry. A different time we have 


3 discussed with him three competencies. . An experienced 


4 trader able to maximize the profit. 2. A work horse who will 
5 simply be at the terminal at the specified time by you and will 
6 act on instructions like me. 3. An analytical machine who 


7 will provide forecast on securities based on raw data, much 


8 better than to what we have now. What do you think, which 


9 angle out of the current three is needed more? 


09:53 10 "Ermakov: Hello. I apologize for not answering to the 
‘lal Friday call. Based on configuration we have now we would need 


12 person No. 2. Let us discuss this later on? 


13 "Rumiantcev: Okay. What time should I 


14 Ermakov: I'll write myself. 


15 jantcev: OK. 


16 Ermakov: Should we post requests?" 


ay ©.. You can stop there, Special Agent. And could we move 


18 ahead to Line 426, please. What is the date of that? 


19 THE COURT: f understand this correctly, is that 


09:53 20 any one of the four you mentioned could be in here, but do we 


21 have an indication that any of the other two were involved in 


22 these chats? 


23 THE WITNESS: Well, where it's specified, they are, 


24 but in these particular -- 


25 THE COURT: They're not? 
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al THE WITNESS: Not at this point. 


2 THE COURT: And so what color is it that comes in when 


3 Mr. Klyushin allegedly is in it? 


4 THE WITNESS: Green is Mr. Klyushin. 


5 : So these early chats are between Mr. Ermakov and 
6 . Rumiantcev? 
i . Correct. 


8 THE COURT: Only those two so far? 


9 THE WITNESS: Correct. Then there is a certain point 


09:54 10 in time where the blue unidentified individual that is denoted 


11 by blue font -- 


12 THE COURT: Yes, and when the blue guy comes in, the 


13 one we don't know, he's not charged in the conspiracy. I'm 


14 allowing it in not for the truth of anything he says but only 


15 the context of the conversation as it flows. We don't know 


16 t blue, all right? So he's not a charged participant. 


17 : Mr. Klyushin joined in May of 2019? 


18 : Correct. 


19 : And we're now looking at November of 2018, correct? 
09:54 20 : Correct, correct. 


21 : Okay. Could you pick up at Line 426, please, on 


22 November 21, 2018 and read to line 456. 


23 A. "Rumiantcev: Greetings. Did you forget not about my 


24 questions? 


25 "Ermakov: Hello. No. My opinion, we need a person who 
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i will be ready to back us up. At this time not always. I can 
2 be at the terminal during the opening. And all our closings 


3 need to be conducted at the trading opening. 


4 "Rumiantcev: What are the time frames for the person to 


is be at the terminal? 


6 Ermakov: Between 16:30 and 18:30. This is a sufficient 


- time frame if things go right. An hour before and an hour 


8 during. This is the maximum time frame. 


9 "Rumiantcev: In other words, 15:30 till 


09:55 10 "Ermakov: Why? The opening now is at 17:30. 


11 "Rumiantcev: Okay, this is clear. Regarding the time, is 


12 this any working day? Or we work 1.5 months every 3 months? 


13 That or until the new year and we will see from there? Or 


14 should I look for a person for the next quarter? 


15 "Ermakov: We work during the reporting period, but 


16 ty it turns out that we work only 1.5 months during 


ay ting time frame. 


18 "Rumiantcev: In other words, we will need a person f 


19 that time frame. November the lst to December 15th, 2018; 


09:56 20 February 1st, 2019, to March 15th of 2019; May 1st, 2019, to 


21 June 15, 2019; August lst, 2019, to October 15, 2019. 


22 "Ermakov: No. Approximately from January 20 to March 10, 


23 April 20 to June 15 and so forth. 


24 "Rumiantcev: October 20, 2018, to October 10, 2018; 


25 January 20, 2019, to March 10, 2019; April 20, 2019, to 
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al June 10, 2019; July 20, 2019 to September 10, 2019. 


2 correct? 


3 ‘Ermakov: Reporting every three months star 


4 year. The active phase begins in mid of the firs 


5 each reporting quarter. 


6 "Rumiantcev: Wel I indicated correct time 


7 frames for 2019, did I 


8 "Ermakov: January 20, 2019, to March 10, 2019; April 20, 


9 2019, to June 10, 2019; July 20, 2019, to November 10, 2019; 


09:57 10 October 20, 2019, to October 15, 2019. 


11 "Rumiantcev: Okay. 


12 "Ermakov: Now, it's the end of the 4th quarter. New 


13 reporting period is starting. January 1, 2019. 


14 "Rumiantcev: About the competency requirements. QUI 


£ 


15 1. Can create/modify/cancel the order. 2. Can 


16 create/modify/cancel a stop bid. 3. Understands the trading 


17 windows, schedule, the order book, the condition of the 


18 portfolio. And I would gladly throw in my daily report. 


19 this enough for starters? 


09:58 20 "Ermakov: Enough, but this must be a trusted person, not 
21 someone from the street." 


22 And it repeats. 


23 "Enough, but this must be a trusted person, not someone 


24 from the street. 


25 "Rumiantcev: Yes, I understand. There is one like that. 
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il He just needs to be explained what exactly is required. Sol 


£ 


2 want to form a set of requirements to estimate the approximate 


3 cost, and write to Vlad, and then come to an agreement with the 


4 person. Generally, everything is clear. About two other 


5 competencies (professional trader and analyst) from your point 


6 of view, we don't need these competencies, right? 


7 "Ermakov: I don't have an answer to this question. 


8 all depends on what we want to have in the end. 


9 "Rumiantcev: I think that Vlad, just like any other 


09:59 10 person in his shoes, wants approximately same thing as others, 


11 spend less, earn more. Therefore, we need to have understanding. 


12 What can make more profits for us. Options: . We can't 


13 implement a lot of trading ideas because of the broker" -—- and 


14 there's an arrow -—-— "we look for another broker. 2. We 
LS implement poor trading ideas, due to low level competencies as 


16 traders (do not know some tricks, do not know how to use bots, 


17 we suck in placing stops and take profits). We are looking for 


18 a trader. 3. We analyze poorly the data we have. We generate 


19 poor trading ideas because of that," and there's an arrow, "we 


£ 


10:00 20 look for an analyst. 4. We can attract more money for the 


21 management. It needs a broker for a legal entity. I do not 


22 have enough time for this task, but within a couple of months, 


23 we will resolve this issue." 


24 Q. Thank you, Special Agent. And there is a reference in 


25 there to QUIK. What is QUIK? 
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1 A. QUIK is an application, rather than an online portal, 


2 an actual application that you would install on a computer 


3 automate your trading. 


4 Q. And there were two references in there to Vlad. What 


5 the defendant's first name? 


6 : Vladislav, and Vlad for short. 


7 : Could we go to Line 531, please. What is the date of 
8 531? 
9 : January 29, 2019. 

10:01 10 : And could you read until Line 537. 


11 : "Rumiantcev: Vlad asked to clarify the situation with 


12 . Why one account has short and another has long? 


13 "Ermakov: This is because when I was closing I purchased 


14 400 more by mistake. But I already closed them in plus. 


15 "Rumiantcev: Okay, got it. Why did you decide to leave 


16 it at Vlad's? 


17 Ermakov: Did not have time to close. 


18 jantcev: It's a pity. It went way down. 


19 Ermakov: I agree." 


10:01 20 : k you, Special Agent. Could we move ahead to 
21 565, please. What's the date? 
22 : February 1, 2019. 


23 : And you see that here there's an inquiry posed by 


24 . Ermakov? 


25 . Yes. 
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i MR. FRANK: Can you just enlarge that box a little 
2 Ms. Lewis. 


3 ‘ What's the inquiry? 


4 ‘ Ermakov asks, "What thoughts you have regarding bringing 


5 in analysts?" 


6 Q. And there appears to be some coding in there that is 

7 erroneously appearing, but could you just read the text that is 
8 Mr. Rumiantcev's response. 

9 A. Rumiantcev replies, "Three options. Number 1: We need 


10:02 10 operators who will trade based on recommendations and would 


11 push those buttons that you will direct to just be on a safe 


12 side. There is such a person. Number 2: We need a trader to 


13 whom we will give securities and directions for the position. 


14 He will further decide on where to put stop bids and take 


15 profits. Number 3: We need an analyst who will study the 
16 materials you have and will give the signals by himself." 
17 O. Continue. 


18 A. "What option we are talking about now? 


19 "Ermakov: We are talking about option 3. 


10:02 20 "Rumiantcev: Thoughts are we have a system for the mass 


21 media analysis, which collects data from the media and social 


22 networks. We will modify it somehow so that a third-party 


23 analyst would think the materials have been found in an open 


24 source. Then we will look for an analyst through our 


25 acquaintances and will try to offer him to make a forecast, 


10:04 1 


10:04 20 


21 


22 


23 


24 


25 
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Aren't you ready yet for a new broker? 
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1 Ermakov: While choosing a new broker it is very 


2 important for us not to raise suspicion. In spite that not all 
3 our trades are profitable, our yesterday's trade scheme may 
4 play against us, even though our volumes are not that great. 


is Just to think." 


6 Q. What is the date that Mr. Ermakov says that, "When 
7 choosing a broker, it's important not to raise suspicion"? 


8 A. That is February the 5th, 2019. 


9 Q. Could we move ahead to the Line 1001, please. What is the 


10:05 10 date? 


11 A. This is March 21, 2019. 


12 Q. Could you read from Line 1001 to Line 1013, please. 


13 A. "Rumiantcev: Good news. Cyprus moves to the interactive 


14 broker. Most likely it will be better there with shorts. 


15 "Ermakov: The issue is that the interactive brokers 


£ 


16 demands information on transactions and on the end 


17 beneficiaries because this broker is monitored by the SEC. 


18 "Rumiantcev: We'll discuss it. 


19 "Ermakov: Please try your best on CRON. 


10:06 20 "Rumiantcev: Greetings! Although the CRON security is 


21 sufficiently liquid, it is not in the upstream brokers' (LEK 


22 Securities) the easy-to-borrow list, therefore we can't do 


23 anything." 


24 There was a website for leksecurities.com sent. 


25 "This is the current upstream broker. It is also an 
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1 American one. In this regard, replacing LEK with interactive 


2 brokers, or IB, may not be creating additional risks. However, 


3 I will try to work on the architecture of interaction with the 


4 upstream broker, including on what information he has and what 


5 he can acquire about us." 


6 A link to FINRA.org for a broker check. 


7 [f you want" —-" this is still Rumiantcev -- "If you want 


8 you can investigate him in order to understand whether OBL, 


9 which is also Otkrite, currently carries any risks working 


10:07 10 through him. I will inform you later separately about my 


11 conversation with OBL about the sharing of our information. 


12 Ermakov: Hello. Thanks for information. I will 


13 definitely investigate it. 


14 "Rumiantcev: Hello. Tentatively on Tuesday I will visit 


15 Otkrite to discuss the security issues (which our data is out 


16 there and what is accessible to the upstream broker, what 


LS happens in case SEC comes in, what will change when the 


18 upstream broker is changed, et cetera). If you have questions, 


19 you may ask." 


10:08 20 Q. And, Special Agent, it appears that this chat extended 


21 over several days. What is the date when Mr. Rumiantcev said, 


22 "What happens in case SEC comes in"? 


23 A. This is March 24, 2019. 


24 Q. Okay, could we move ahead to Line 1069. The next ex 


25 is a little longer. And could you tell us what date it st 
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alt on 1069. 


2 A. April the 12th, 2019. 


3 Q. Could you read from 1069 to 1123, please. 


4 A. "Rumiantcev: Taxi booking service Uber filed a $1 billion 


5 initial public offering with the US Securities Commission on 


6 April 11. The placement will take place on the New York Stock 


h Exchange in May. The initial share price will be announced a 


8 few days before the start of trading. In its bid, Uber 


9 presented the financial figures for 2018. The company's 


10:09 10 revenue for the year rose 42 percent to $11.3 billion. Every 


‘lal month 91 million people use taxi services in more than 700 


12 cities. Should we participate? Usually the price jumps big 


13 one way or another at the IPO. 


14 "Ermakov: Hello. Is this open source information? 


15 "Rumiantcev: Yes." 


16 Q. And then you see that there are certain attachments that 


Ly are sent? 


18 : Yes. 


19 : And then at Line 1074, what does Mr. Rumiantcev say? 
10:09 20 : "Greetings." 


21 : Okay. And then pick up at Line 1078. 


22 : "Will such an information be any of use for you, or we 


23 look at our data? 


24 Ermakov: Hello. We have this info. We don't need this. 


25 We need people that are based on our introductory information. 
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alt "Nikolai Rumiantcev: Need to do atest. But we have to 


2 figure out how to do it, so that it is not clear where the 


3 source of information comes from. Possibly, distort some data 


4 but keep the general essence. And to ask to do the prediction 


5 about security. Then to see how well does the person make this 


6 prediction. 


7 "Ermakov: Hello. We have this info. We don't need this. 


£ 


8 We need people who, on our mission, for example, a week before 


9 the planned reporting date of a particular company, the company 


10:10 10 or the company we give will analyze these companies on the 


11 basis of information from open sources. They would study the 


12 Situation with previous reports, forecasts of analysts, funds, 


13 and so on, and give their forecast for these companies. Based 


14 on all that and our own vision, we make the final decision. 


15 Often, we do not have enough hands to analyze the situation in 


16 depth, to understand the analyst's opinions, to understand the 


17 expectations, whether the security is overvalued or vice versa. 


18 This is precisely what type of analytics we need. 


19 "Rumiantcev: Okay, I will think. The main emphasis is to 


10:11 20 have the person 'a trusted one' who won't start leaking the raw 
21 material when he or she gets access to it." 
22 Q. And let me just stop you right there. That appears to be 
23 some inadvertent green in there, but that should be all black? 
24 A. All black, yes. 


25 Q. Okay. 
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1 : Ermakov: He will not get access to anything. He will 


2 ly provide analytics from open sources and a conclusion. We 


3 ill make decisions on our own based also on our own analysis. 


4 "Rumiantcev: That or should we bring in a person from the 


5 street and he will be giving us only preliminary predictions, 


6 and only your colleagues will be working with the raw material 


7 based on predictions from specialist? Got it. Well, then in 


8 this case we can find one on the oil market, for what it's 
9 worth." 


10:12 10 Correction to spelling "find." 


11 "Ermakov: What is needed is experience in company 


12 analysis, financial reporting, and decision-making. These are 


13 usually bank workers and credit inspectors, but in principle 


14 they can be from other areas as well. 


15 "Rumiantcev: Got it. I will get down to work with this. 


16 Is there understanding about conditions? Will there be any 


18 Ermakov: For now, I suggest we try 1-2 people on fix, 


19 and then we'll see. In fact, the work is big, complex, huge 


10:13 20 volume to understand. It is necessary to analyze 200-300 


21 potential targets per quarter -- but that is in the future. 


22 Now we have to try on a small selection sample and see how this 


23 may simplify and help solve our task. What is the situation 
24 with our accounts now? 


25 "Rumiantcev: VKO1, AV, BV, VKO2 (new account) ready for 
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al battle, money is there. NR (mine) —- still under the control of 


2 a partner. SA - open, no money yet, but there is no QUIK yet 


3 but should be there in week if documents will be quickly 


4 signed. USS - in the process of opening a new account, there 


5 will be 300,000 U.S. dollars, time frame, two weeks." 
6 Q. Let me stop you right there, Special Agent. We see some 


7 initials. Whose initials are VK? 


8 : ladislav Klyushin. 


9 : And then you see AV, BV? 


10:14 10 A. Yes. AV appears to be a typo for AB, AB being Alexander 


11 Butbaev, which we were looking at the other day. Boris 


12 Varshavksiy is BV, and then the VKO1 and VKO2 are references to 


13 numbered accounts associated with Vladislav Klyushin. 


14 : Whose initials are NR where it says "mine"? 


15 : Nikolai Rumiantcev. 


16 ‘ And then SA? Is that a name we haven't heard yet? 


Ly 7 Correct. 


18 . And then there's USS? 


19 : These are the initials for Sergey Uryadov. 


10:14 20 : Thank you. And then there's a reference in the next line 
21 which you haven't read yet. Mr. Rumiantcev says, "The trust 


22 manager is holding back a bit -- time frame beginning of May." 


23 Do you have an understanding of what "trust manager" 
24 refers to? 


25 A. Trust manager -—- 
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al MR. FERNICH: Object. 


2 THE COURT: Sustained. 

3 ‘ Okay, can you continue the reading. 

4 THE COURT: How much more of the reading is there? 
5 MR. FRANK: Probably about ten minutes, your Honor. 


6 A. "The trust manager is holding back a bit -—- time frame 


7 beginning of May. My principal problem is bureaucracy, new 


8 clients would not sign paperwork in a speedy manner while those 


9 are needed in large quantities. Each needs to be explained, as 


10:15 10 what this is and why this is needed. Plus signing. It takes a 
11 very long time for Cyprus to create the trust manager and we 
12 are not the only ones they have in this regard. Ready to help 
13 with trading until the trust, but let know ahead of time when 


14 you need help. 


iS) "Ermakov: Send me the accounts, the new ones, so that 


16 install them all for ourselves there. 


17 "Rumiantcev: VK2 is already accessible from Vlad's QUI 


18 There is no QUIK for SA for now. I am working on it. But of 


19 course I will send over everything when it's done. 


10:16 20 Ermakov: In other words, there are two accounts via the 


21 IK? 


22 "Rumiantcev: No. Just switch the account in the combo 


23 box. The trust enables sending one task to multiple accounts 


24 at once. Can't do that for now. For different individuals 


25 different terminals need to be used, switching accounts of the 
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i same person need to be done within one terminal. 


2 "Ermakov: Got it. Good morning. What is the situation 


3 with accounts? The coming week will be very busy. I'd like to 
4 be able to work at maximum. 


5 "Rumiantcev: Greetings! So far it is the same. 


6 Regarding the others, what's left to do is to connect the QUIK 


i and deposit the money. One sent yesterday. I don't know about 


8 when the other will send it. Otherwise the accounts are opened 


9 for everyone. They give QUIK only after the first deposit. 


10:16 10 "Ermakov: What is the problem with deposits? 


11 "Rumiantcev: This perhaps is a question for Vlad. 


12 don't tell the client 'give me money.' Right now 4 accounts 


13 are ready, the 5th I think will be ready on Tuesday, the 6th by 


14 Wednesday or Thursday, though I can't guarantee for that one. 


LS "Ermakov: Will the money for the 5th one be in on 
16 Tuesday? What are the sums for the 4 accounts? You can give 
17 me the approximate. 


18 "Rumiantcev: Right now all the accounts that are AB, BV, 


19 and two Vlad's accounts in total have $2.7 million. The 


10:17 20 best-case scenario, the 5th should be ready by Tuesday and will 


21 have about $400,000. We expect the trust manager by May 1, and 


22 perhaps another week in order to connect the accounts to it. 


23 "Ermakov: When the money will come there? 


24 "Rumiantcev: Already sent. I think Monday-Tuesday, but 


25 still needs the QUIK to get hooked up. They give QUIK only 
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A after the first deposit." 


2 Q. Thank you, Special Agent. Could we jump ahead to 1470. 


3 THE COURT: What dates are we on now? 
4 : What is the date of Line 1470, Special Agent? 
5 ‘ April 27, 2019. 


6 : Could you read from 1470 to 1472. 


7 : "Rumiantcev: Hello. Vlad asked to tell him what happened 


8 to the GRUB," G-R-U-B "and I will do the report today, not on 


9 monday (I downloaded the deals from the terminals at night 


10:18 10 before closing). I did not quite understand why you were 


11 buying GRUB expensive (75 plus) on AB and BV? Is this an 


12 error, a wrong choice, or was there some idea behind it? 

13 "Ermakov: This was an erroneous trade." 

14 Q. Could we jump ahead to 2174, please. What is the date of 
15 2174? 

16 : May 9, 2019. 


Af : Could you read the next four lines, please. 


18 , "Ermakov: Have you seen SATL? 


19 "Rumiantcev: No. What's up with it? 


10:19 20 "Ermakov: These are the two positions that we could not 


21 short this week, but really wanted. INGN and SAIL, S-a-i-l. 


22 "Rumiantcev: I just wrote a letter about this to Vlad. 


23 The problem is in the work." 


24 Q. ld we move ahead to 2908, please. What's the date of 


25 
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al : June 6, 2019. 
2 ‘ And could you read from 2908 to 2911. 


3 : "Ermakov: Check out HOME, H-O-M-E, which we could not 


4 short but really wanted to. 


5 "Rumiantcev: We will resolve this issue very soon. 


£ 


Tor sure, 


6 Ermakov: Summarizing results for the quarter, 


7 we have fucked up three good opportunities: INGN, SAIL, and 


8 HOME, 30, 30, 33 percent respectively. Here is for today." 


9 Q. And, actually, if we could go back briefly to 2353. 


10:20 10 Special Agent, if you could tell us what the date is of 2353. 


11 . May 13, 2019. 


12 ‘ That's the day that Mr. Klyushin joined the chat? 


13 : Correct. 


14 : Could you read from 2353 to 2374. 


LS : "Klyushin: Kolya, why don't we open our interactive 


16 brokers by ourselves? Just for information. 


17 "Rumiantcev: To be brief, because the support is 


18 practically absent in Russia. 


19 "Klyushin: Practice your English. 


10:21 20 "Rumiantcev: And the broker will see all our 


21 transactions. We don't fucking need it." 
22 Rumiantcev continues: "Language is not the problem here," 


23 replying to the "Practice your English." 


24 Klyushin replying to Rumiantcev saying, "And the broker 


25 will see all our transactions, we don't fucking need it," says, 
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1 I was told that all Otkrite does is, it steals clients' 


2 trading deals and copies it. Fine. We'll go far this way. I 


3 will discuss this with Kolya verbally. 


4 "Rumiantcev: The issue is that there are a bunch of 


5 people involved in our day-to-day problems, but their 


6 motivation to help and resolve matters is even less than what 


i Katusha Developers have." 


8 The individual in blue unidentified: "Most likely --" 


9 Q. Who is he responding to? 


10:22 10 A. He's responding to Vladislav Klyushin saying, "Kolya, why 


11 don't we open an interactive brokers by ourselves just for 


12 information." 


13 Individual in blue: Most likely from fear of direct 


14 trading and client visibility. For SEC." 


15 "Rumiantcev -- 


16 THE COURT: Now, remember, he's not a charged person, 


ay so that you can't take the truth of what he's saying. Just 


18 understand the flow of the conversation, it puts it in con 


19 Thank you. 


10:22 20 THE INTERPRETER: Your Honor, may the Interpreter 


21 respectfully request to see the Russian version of the text 


22 because it doesn't make sense to interpret from English back to 


23 Russian when the original version is in Russian. 


24 MR. FRANK: Your Honor, the translation has not been 


25 disputed, and we're —— 
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alt THE COURT: I think we need to stick with what we 


2 have, but we can -- I'm sorry. Are we going too quickly for 


3 you? 


4 THE INTERPRETER: Yes. 


5 MR. FRANK: We'll slow it down. 
6 THE COURT: Slow it down. Thank you. 
7 Q. Could you pick it up, Special Agent, at 2363 and read it a 


8 little more slowly. 


9 A. Yes. 


10:23 10 2363, “Rumiantcev: It's that it's not obvious for you 


11 that there is so much attention around you. 


12 "Individual in blue: Via the American trader." 


13 Rumiantcev responding to individual in blue who said "via 


14 the American trader," Rumiantcev replies, "I mentioned it 


15 earlier. And the broker will see all our transactions. The 


16 fuck we need this. 


LS Ermakov replying to Rumiantcev who said that "It's not 


18 obvious for you that there is so much attention around you," 


19 smiley face, Ermakov responds: "Not yet," smiley face. 
10:23 20 "Rumiantcev: Now all our transactions are blended among 


21 all OBL, which is Otkrite clients." 


22 Ermakov replying to Rumiantcev who said, "I mentioned it 


23 earlier, and the broker will see all our transactions. We 


24 don't freaking need it," Ermakov replies, "Broker sees it even 


25 now and can follow up on it. The regulator is much more 
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1 important here." 


2 Vlad replying to Rumiantcev who said, "It's that it's not 


3 obvious for you that there is so much attention around you," 


_ 


face, Vlad replies, "You just keep sending the reports 


4 smiley 


5 as you love to do on what was done and then everything will 


6 become obvious." 


7 Individual in blue: "Here is a bit more about brokers —- 


8 where I saw about Saxo Bank," and there's a link to a Russian 


9 website. 


10:25 10 Individual in blue continues: "REurope in this regards is 


1] probably more preferable though the question remains to what 


12 extent they cooperate with the American SEC. 


13 "Rumiantcev: Created the trust manager, they rewrote 


14 their regulations to be fit for us. This is a very difficult 


15 thing to do. They are making a mobile QUIK, lots of fucking 


16 work with them. Soon they will start working on data retrieval 


ike) API," which stands for application programming interface. 


18 "Vlad, complained about lots of documents they are 


19 bringing for signing. The manager created 200 plus pages of 


10:25 20 documents for us, which we have to fill out ourselves." 


21 Vlad responds to individual in blue who said, "Europe in 


22 this regards is probably more preferable though the question 


23 remains to what extent they cooperate with the American SE 


24 Vlad replies, "Our people from Switzerland say that they're 


25 blocking accounts with no questions asked for six months if the 
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1 profits are above 20 percent." 


2 Q. And, Special Agent, what is the date when Mr. Klyushin 


3 says that "In Switzerland they're blocking accounts with no 


4 questions asked if the profits are above 20 percent"? 


5 MR. NEMTSEV: Objection. 


6 THE COURT: Overruled. 


7 A. The date is May 13, 2019. 


8 Q. Can we move ahead to Line 3216, please. What is the date 


9 of Line 3216? 


10:26 10 A. June 13, 2019. 


11 Os Could you read the next 16 lines, please. 


12 A. "Nikolai Rumiantcev: Hello. We need to record the profit 


13 on AB and BV, want to transfer our part to VK1l. This takes up 


14 some time on partners' end, up to 3 weeks. We want that the 


LS money is ready on VK1 by the start of trading. What to do 


16 about open positions on CARG and TLRY? Are we recording the 


17 profit by the estimated value of the portfolio? 


18 "Ermakov: What are the losses on each account should they 


19 be closed now? 


10:27 20 "Rumiantcev: BV, negative 22,397. AB, negative 24,164. 


21 Ermakov: How much income was there for them per day? 


22 jlantcev: For today? Or yesterday? 


23 Ermakov: Yesterday and today?! 
24 "Vladislav: For a month earned approximately 460 on 


25 Sasha's and 260 on Boris'." 
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1 : That's Mr. Klyushin? 

2 ‘ Correct. 

3 Klyushin continues: "425 Sasha. 

4 "Rumiantcev: What the hell is this de-anonymization? How 
5 do you suppose one would trust you enough to go with you on a 

6 covert mission?" 

7 Q. And what names has Mr. Klyushin used in the prior two 


8 lines? 


9 A. Sasha and Boris. 


10:28 10 O. Okay, can you continue after "covert mission." 


11 A. Klyushin replies to Rumiantcev's question, "How do you 


12 suppose one would trust you enough to go with you on a covert 
13 mission," Vlad replies, "This is not about me. 


14 "Rumiantcev: And who do you suppose publishes screenshots 


15 full names? Smiley face. 


16 "Vladislav: I'm about finances. It was an accident." 


ay Q. Do you have the date on which Mr. Klyushin says "It was an 


18 accident"? 


19 A. June 13, 2019. 


10:29 20 : Could we move ahead to 3585, please. There's just two 


21 ft. What is the date of 3585? 


22 . 3585 is July 8, 2019. 


23 : Could you pick up at 3585 until 3589. 


24 ‘ "Ermakov: Hi. What other options for brokers are there? 


25 "Rumiantcev: I haven't researched. We have even open an 
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1 B, or interactive broker account. Finding pitfalls when 


2 working with a broker is quite a long process. I would not 


3 like to be spread thin. Vlad did not yet deposit the money in 


4 Saxo. I am ready to move on when we get a decision from him 


5 (like it or not). 


6 "Ermakov: I already told Vlad, need to think about 


7 reducing accounts. Such a number of accounts with the same 


8 securities with the same broker is a bad idea. 


9 "Rumiantcev: I think the goal was to ‘collect 10 million 


10:31 10 U.S. dollars." Quote/unquote around the "collect 10 million 


de. U.S. dollars." 


12 "We can open all other accounts with another broker, but 


13 first we need to work with him for a while. 


14 Ermakov: Okay, we need to talk together and assess the 


15 risks. To collect 10 million is not a problem. The problem is 


16 to manage them without risks and safe for everyone without 


17 arousing suspicion." 


18 : Okay, we don't see Mr. Klyushin in this exchange, but by 


19 date, was he involved in this chat? 


10:31 20 ; Yes. 
21 : Could we move ahead to the last section, 3980, please. 


22 is the date of 3980? 


23 . duly 18 of 2019. 


24 : You know, I apologize, Special Agent. Before we get to 


25 3980, could we do 3687. There's one entry I forgot. 3687 is 


Case 1:21-cr-10104-PBS Document 214 Filed 02/21/23 Page 64 of 161 


alt which date? 


2 A. This is July 13, 2019. 


3 Q. Okay. And could you read 3687 to 3690, please? 


4 A. "Nikolai Rumiantcev: It is generally hard to analyze the 


5 status of a security based on the social media networks. We 


6 have the TSLA," or Tesla, "collection set in Twitter at 


18,000 messages 


7 100 percent. Based on the ticker only, we get 


8 per week. I can download into XLSX," or Excel. "You can try 


9 looking through it with your own eyes, maybe something will 


10:32 10 catch your eye in case you are interested. I'm not giving up 
11 my hopes that our capabilities to collect news and posts in 


12 social media may help us somehow." 


13 Vlad replies to Rumiantcev saying, "I'm not giving up 


14 hopes that our capabilities to collect news and posts in social 


15 media may help us somehow," smiley fact, Vladislav Klyushin 


16 replies, "We are trading only due to these opportunities, all 
LS] newer networks need monitoring as well." 


18 Q. Okay, thank you. And now can we move to 3980, please. 


19 And this date is? 


10:33 20 : This is July 18 of 2019. 


21 : Would you begin with 3980. 


22 : "Vladislav Klyushin: So what did we earn today?" 


23 F And then there's an attachment? 
24 : Correct. 


25 : And then he says what? 
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1 A. Ermakov responds: "About 350 and another 350 in the mind. 
2 Sasha the most among the rest. 
3 "Klyushin: Our comrades are wondering." 


4 MR. FRANK: Could we stop right there, and I real 


5 it's hard, Ms. Lewis, because we're in the Excel, but coul 


6 please display Exhibits 52 and Exhibit 50. 


. Q. Those are the attachments, Special Agent. Have you had an 
8 opportunity to review those? 
9 A. 


10:34 10 O. Who's depicted in Exhibits 52 and 50? 


11 A. On the left, 52 is Sergey Uryadov. On the right is Boris 


12 Varshavksiy in Exhibit 50. 


13 MR. FRANK: I offer 52 and 50. 


14 (Exhibits 50 and 52 received in evidence.) 


15 Q. Okay. So those are the two attachments Mr. Klyushin has 
16 just transmitted in the chat? 


17 A. 


18 Q. Can we go back to the chat and pick up where we left off. 


19 So Mr. Klyushin says, "What did we earn today? Our comrades 


10:34 20 are wondering." Could you continue, please, at 3987. 


21 A. After sending those pictures we just looked at, Ermakov 
22 replies: "Vlad, you are exposing our organization. This is 
23 bad. 


24 "Nikolai Rumiantcev: Vlad, stop sending to Threema." 


25 Klyushin replies, "So sorry." 
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1 Ermakov: And that's how they get you and you end up as a 


2 fendant in a courtroom." 
3 : How does Mr. Klyushin respond? 


4 ‘ Klyushin responds, "Removed. Open a chat with us already. 


5 "Ermakov: Go ahead and create. It was a bad move now. 


6 "Klyushin: Sorry. Did a dumb thing. 


7 "Rumiantcev: I suggest to recreate the chat with the 


8 deletion of attachments in Threema, or switch to ours if ready. 


9 "Klyushin: I will delete this one on my end." 


10:36 10 Q:. Special Agent, when Mr. Rumiantcev says, "I suggest to 


11 recreate the chat with the deletion of attachments in Threema 


£ 


12 or switch to ours if ready," earlier you testified about an 


13 M-13 chat application? 
14 A. 


15 Q. And whose iCloud accounts did you find the M-13 chat 


16 application in? 


17 : ladislav Klyushin, Nikolai Rumiantcev, and Igor Sladkov. 


18 ‘ Did you find the substance of any of those communications 


19 that M-13 chat application? 


10:36 20 ; No content, no. 
21 Q. And you found an image associated with the chat 
22 application? 
23 A. 


24 Q. And the image had a —- 


25 NEMTSEV: Objection. 


10:37 10 


10:37 20 


21 


22 


23 


24 


25 
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What was the symbol of the image? 


THE COURT: I'll allow it. What was the image? 


THE WITNESS: The image depicted two chat bubbles with 


a lock inside the chat bubble. 


lyushin says at Line 3998, "I Will delete this one on 


Did you find the Threema appl ion on Mr. Klyushin's 


Did you find this chat on Mr. Klyushin's iCloud account? 


No. 


Where did you find it? 


In Nikolai Rumiantcev's Apple account. 
Thank you. You can take this down. Who was it in this 
who said —- 


THE COURT: are we doing timing-wise? 


MR. FRANK: I just wrapping up, your Honor. 
COURT: right, thank you. 


FRANK: if you could just go back one moment. 


You in Line 3990, Mr. Ermakov says, "And that's how 


get and you end up as a defendant in a courtroom"? 
Yes. 
And that's July 


2019, yes. 


Did there come a time when the defendant was arrested? 


MR. FRANK: You can take that down. 


10:38 10 


10:38 20 


21 


22 


23 


24 


25 


Case 1:21-cr-10104-PBS Document 214 Filed 02/21/23 Page 68 of 161 


Yes. 


Where was that? 


On an airport tarmac in Sion, 


MR. FRANK: Could we have Exhibit 245, 


ffer it. 


This is a stipulation, 


"Stipulated: 


that the Defendant, Vladislav Klyushin, 


and 


Switzerland. 


Exhibit 245 received in evidence.) 


please, and 


I'll read it into evidence. 


The parties hereby stipulate and agree 


Switzerland, on March 21, 


time, which was 12:30 UTC 


That's Zulu time? 


"This stipulation is admissible in evidence." 


a pen register for an 


EFarlier, Special Agent, 


IP address. 


pen registers in this case? 


A. 


2021, 


time." 


was arrested in Sion, 


at approximately 13:30 local 


you testified about obtaining 


Did you also obtain other 


Q. Are you familiar with an individual by the name of 


Zhannetta Klyushina? 


A. I am. 


MR. FRANK: 


coul 


d have 


This is another stipulation. 


Exhibit 246, 


Exhibit 246 received in evidence.) 


and I 


MR. FRANK: "The parties hereby stipulate and agree 
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i that Defendant Vladislav Klyushin was married to Zhannetta 


2 Klyushina, who is also known as Zhanna Klyushina, at all times 


3 relevant to the charges in the indictment. This stipulation is 


4 admissible in evidence." 


5 OF Did there come a time when you obtained a pen register 


6 pertaining to Zhannetta Klyushina? 


8 ‘ For what? 

9 : For a WhatsApp account for Zhanna's WhatsApp account for a 
10:39 10 telephone number. 
11 Q. How did you determine it was Ms. Klyushina's WhatsApp 
12 account? 


13 A. The telephone number associated with this WhatsApp account 


14 found in Ivan Ermakov's contacts in his Apple account. 


15 MR. FRANK: Could we have Exhibit 12 on the left and 


16 on the right, please, and I'd offer them. 


17] (Exhibits 12 and 12A received in evidence.) 


18 . What is Exhibit 12? 


19 : The Russian language version of the contact card for 
10:39 20 Zhanna Klyushin -- or Klyushina. 


21 Q. This was obtained where? 


22 A. From Ivan Ermakov's Apple account, and you'll see the 


23 number plus 7-985-233-1413. 


24 Q. Okay. And we have the English translation on the right? 


25 A. 
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O. And the last four digits of Ms. Klyushina's phone number 


are 1413? 


10:40 10 


A. Yes. 


MR. FRANK: And if we could have Exhibit 11 in 


evidence. 


Q. What is Exhibit 11, Special Agent? 


A. This is the subscriber information for the 


Apple account. 


Q. And could we look on the right side of this exhibit, the 


10:41 20 


21 


22 


23 


24 


25 


last four digits of Mr. Ermakov's phone number right there in 


the column under Facetime? 


A. 00085. 


MR. FRANK: Could we have Exhibit 153, please. 


O.. What is Exhibit 153? 


A. These are certain rows of the pen register, which is the 


caller 


ID for the WhatsApp account associated with -- for 


Zhanna Klyushina, Vlad's wife. 


Q. Okay, I want to direct your attention to the entries on 


the date of Mr. Klyushin's arrest, March 21, 2021, and in 


specific, I want to direct you to a communication at 12:28. 


And that's UTC time? 


A. Correct, Universal Coordinated Time. 


O. Okay. Do you see that there's an exchange there between a 


number ending in 1413? Whose number is that? 


A. Zhanna. 
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1 : . Klyushi 


2 : . Klyushina. 


3 ‘ on the right? 


4 F . Ermakov. 


5 : Okay, so that exchange between Ms. Klyushina and 


6 . Ermakov was at 12:28 Universal Time? 


7 : Yes. 
8 Q. Okay. Then we see a series of exchanges beginning at 
9 12:30 UTC with a 0944 number? Do you see that? 
10:42 10 : Yes. 
11 : And when do those exchanges end with the 0944 number? 
12 : At 12:34 is the last exchange with 0944. 


13 : And do you see, Special Agent, that after 12:34 


14 MR. FRANK: Ms. Lewis, if you could just go down one 


15 No. If you could go up a little bit and just move 


16 -—- highlight down one line. 


17 : That's the final exchange with the 0944 number? 


18 : Yes. 


19 ; And then there's a gap. Do you see that? 


10:43 20 : I do. 


21 : long is the gap after 12:34 Universal Time? 


22 . 24 minutes. 


23 : What happened at approximately 12:30 Universal Ti 


24 ‘ Mr. Klyushin was arrested on the tarmac at the Si 


25 airport in Switzerland. 
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1 ©. What happened after the 24-minute gap at 12:58 Universal 


2 Time? 


3 A. The first communication is with Mr. Ivan Ermakov. 


4 MR. FRANK: Thank you. No further questions. 


5 THE COURT: Why don't we stand and stretch for a 


6 second. 


7 (Discussion between the Court and Clerk.) 


8 MR. FRANK: Ms. Molloy, did I offer 153? 


9 THE CLERK: If that's the one you were just speaking 


10:44 10 No. 


11 MR. FRANK: I offer it. 


12 (Exhibit 153 received in evidence.) 


13 (Discussion off the record.) 


14 THE COURT: Why don't we take our break now, and then 


15 try to come back at 11:15, I think is a good time for everyone. 


£ 


16 It's been a lot of testimony for the interpreters and the court 


17 reporter and all of us, the rest of us, so -—- not to mention 


18 the witness. 


19 (Jury excused.) 
10:45 20 THE COURT: You're estimating about an hour and a 


21 


22 . NEMTSEV: hope to be an hour anda half. 


23 COURT: I understand. So 11:15, 12:15, quarter of 


24 : start with your summary witness. 


25 . KOSTO: Could we perchance get Ms. Shah on after 
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1 Special Agent Hitchcock? 


2 THE COURT: If it's literally -- 
3 MR. KOSTO: Ten minutes. 


4 THE COURT: Not even ten minutes because she's just 


5 going to verify her e-mail. 


6 MR. KOSTO: What she sent and where she sent it. 


7 THE COURT: That's all, so that should be five 


8 minutes. 


9 u feel prepared for that? 


10:46 10 . FERNICH: I don't think there's any dispute as to 


12 . NEMTSEV: There's no dispute as to the email, your 


13 Honor, but I have a feeling they're going to ask her, "Why did 


14 you send it? What did they do? What do they typically do?" 


iS) THE COURT: I told you what I said. I mean, she could 


16 potentially come back as a rebuttal, but the question is really 


LS} on cross whether or not you're going to ask about the 


18 conviction of the company; and if you do, it may take longer 


19 than 15 minutes, so that's the one thing I'm playing in my 


10:46 20 mind. 


21 . FERNICH: Well, that wouldn't be a rebuttal 


22 witness. I mean, that would be —- 


23 THE COURT: It just may take longer. 


24 MR. FERNICH: Oh, you mean crossing her? 


25 THE COURT: Yes. 
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i} MR. NEMTSEV: don't intend to —- if she's just going 


2 to come in and say "This is the e-mail that I sent --" 


3 THE COURT: "This is practice why I sent it," that 


4 should take three minutes. 


5 MR. FERNICH: Judge, just one thing quickly on the 


6 venue that we were talking about before. In the Timothy Smith 


7 merits brief, all of this is set out very extensively, filed 


8 last week, Pages 36 through 37 and Note 13: "Federal Courts 


9 uniformly recognize that the government bears the burden of 


10:47 10 proving venue to the jury if venue is an issue," and there's a 


11 footnote citing cases from every circuit, including US v. 
12 Scott, 270 F. 3d 3430 at Pin Site 34, First Circuit, 2001. 


13 SO -- 


14 THE COURT: Can I just ask you, is that briefed, the 
15 one that went to the Supreme Court? 


16 MR. FERNICH: Yeah. So what your Honor read from the 


17 USG was the opposition brief to the cert petition since 


18 Smith —- 


19 THE COURT: In that 


10:47 20 MR. FERNICH: Yes. 


21 THE COURT: The one you just read. We'll look. Okay, 
22 thank you. 
23 (A recess was taken, 10:47 a.m.). 


24 (Resumed, 11:21 


25 THE CLERK: All 


11:21 10 


11:22 20 


21 


22 


23 


24 


25 
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(Court and Jury enter.) 


THE COURT: It's cross. Time for cross. 


seated. Thank you. 


Q. 


A. 


Q. 


MR. NEMTSEV: May 


THE COURT: Yes, 


go right ahead, Mr. 


I proceed, Your Honor? 


DAVID HITCHCOCK, Previously sworn 


CROSS-EXAMINATION 


BY MR. NEMTSEV: 


Good morning, Special Agent Hitchcock. 


Good morning. 


You may be 


Nemtsev. 


Outside of the courtroom, you and I have never met or 


spoken before, correct? 


A. 


Q. 


Exchanged emails, but 


don't believe we've spoken, no. 


Maybe we said hello to each other across the hall but 


never actually sat down and spoken about this case or any other 


substantive matters, 


A. 


Q. 


case, 


You and Mr. Frank and Mr. Costa, the prosecutors in 1 


have worked very closely together on this investigat 


correct? 


A. 


Q. 


Over the course of the last four and a half 


correct? 


A. 


Since the fall of 201 


a 


correct? 


Which is approximate] 


y 


four and a half years; 


would you 
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1 agree? 


2 A. Since the fall of 2019. 


3 Q. And in preparation for your testimony today before the 


4 jury or your preparation for the testimony over the course of 


5 three days that you gave, you and Mr. Frank rehearsed, correct? 


6 A. No. 


7 Q. You didn't rehearse some or all of the parts of your 


8 testimony? 


9 A. We prepared, but there was no rehearsing. 


11:22 10 ; Did he ask you questions, did you give him answers? 


12 Q. Were those questions the same or similar to the ones that 


13 he gave to you over the course of three days? 
14 A. Similar, yes. 


15 Q. You also worked with Mr. Frank and Mr. Kosto to narrow 


16 down the millions of documents in this case, did you not? 
17 A. Yes. 


18 Q. And then the documents that you narrowed down to were the 


19 documents that assisted, helped your case, correct? 


11:23 20 ; They were some of the documents that we relied upon. 


21 ; You and I have never rehearsed, correct? 


22 : We have not spoken about the case, no. 


23 ‘ You and I have never sat down to select documents that 


24 assist Mr. Klyushin in connection with his litigation 


25 positions, have we? 


11:23 10 


11:24 20 


21 


22 


23 


24 


25 
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We have not met, no. 


And you've been sitting in court since the beginning of 


trial 


correct? 


7 


On and off, yes. 


And you've been listening to the testimony of witnesses, 


correct? 


A. On and off, yes. 


Q. And you've previously interviewed many or most of these 


witnesses; 


is that correct? 


A. A majority, yes. 


Ox And i 


witnesses 


t did 


not come aS a surprise to you what these 


testi 


A. Correct. 


Fied to, correct? 


Q. You testified that you've been a special agent with the 


Since March of 2019. Is that accurate? 


March of 2009. 


Yes. 


I'm sorry. 


March of 2009. Is that accurate? 


So approximately fourteen years at this point? 


Yes. 


And what does it mean to be a special agent? 


investigate crimes, usually falling under Title 18 of 


the U.S. Code. 


What does the designation "special" mean? 


I'm an investigator. My title is special agent, but the 
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1 special portion doesn't have significance. 


2 Q. Isn't it a fact that every agent at the FBI is a special 
3 agent? 


4 A. Correct. 


5 Or And you testified that you co-led a team to investigate 


6 Mr. Klyushin since the fall of 2019; is that correct? 


7 A. Yes, sir. 


8 QO. And am I correct that the team was also co-led by 
9 Special Agent Kang? 


11:24 10 A. Yes. 


11 Q. And am I correct that Special Agent Kang retired on 
12 September 30th, 2022? 


13 A. Approximately, yes, that's correct. 


14 Q. And you testified that the team that you co-led consist 


15 of FBI agents, computer experts, linguistic experts; is that 


16 correct? 


17 : Yes, I did. 


18 : And it's fair to say that it was a large team of people? 


19 : Yes. 
11:25 20 ; More than a dozen? 
21 : Throughout the course of the investigation, yes. 


22 : More than two dozen? 


23 P I don't believe so. 


24 : And you also received assistance in your investigation 


25 from the SEC; is that correct? 
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al . Assistance? 


2 < Yes. 


i : Could you clarify? 


4 ‘ Did the SEC provide you with documents and other 


5 assistance? 


6 A. They provided us with information, yes. 


7 Q. And did you discuss with agents of the SEC details about 
8 this case? 
9 A. At various points, yes. 


11:25 10 : Did they provide you help, assistance in your 


11 tigation? 


12 : They provided us information such as the information that 


13 filing agents involved in the case were both Toppan Merrill 


14 Donnelley Financial, things like that, yes. 


LS ¢ And you also received assistance from international law 


16 forcement; is that correct? 


Ly P Yes. 


18 . Including Switzerland, correct? 


19 Correct. 


11:26 20 : And am I correct it was an SEC subpoena that was issued in 


21 November of 2019 that triggered the two filing agents in this 


22 case, DFIN and Toppan Merrill, to investigate the potential for 
23 intrusion? 
24 A. There was a subpoena from the SEC around that time frame, 


25 
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1 Q. Did you or anyone at the FBI assist with drafting or 


2 formulating the subpoena requests that went out from the SEC to 
i) these two filing agents? 


4 A. No. 


5 QO. And as part of your investigation of this case, you 


6 obtained search warrants and issued subpoenas, correct? 


7 A. 


8 Q. And am I correct that you issued 43 search warrants? 


9 A. I don't know the exact number, but that sounds plausible. 


11:26 10 O. And those warrants were for, amongst other things, email 
11 accounts, iCloud accounts, Facebook accounts, correct? 

12 ‘ Yes, sir. 

13 : You also issued dozens of subpoenas, correct? 

14 : Yes. 


LS : And among the 43 search warrants that you issued in this 


16 case, at least two related to Mr. Klyushin's iCloud; is that 


Ly correct? 


18 A. That sounds correct. 


19 Ox £ remember correctly, at least one search warrant 


11:27 20 related to Mr. Klyushin's email account, correct? 
21 A. That sounds correct. 


22 Q. And isn't it a fact that iCloud is a backup on the cloud, 


23 on the Internet, a repository for information from a person's 


24 iPhone and MacBook, correct? 


25 A. For their Apple account which can be associated with those 
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al devices, yes, that's correct. 
2 Q. So it is associated with all the Apple devices that they 
3 have, which could include a MacBook, an iPhone, an iWatch, an 


4 iPad, or any other device? 


5 A. £ could clarify, the devices that they choose to attach 


6 to a particular Apple account, yes. 


7 Q. And it could be multiple devices and multiple versions of 


8 iPhones and MacBooks, correct? 


9 A. One to many, yes, that's correct. 


11:28 10 Q.. As a result of the iCloud backups, and I believe you 
Li testified to this, the iClouds could contain messages, emails, 


12 pictures, videos, documents, and any other information, 


13 COrrect? 


14 A. It can contain those types of documents, yes. 


is) QO. And in connection with your search warrant of 


16 Mr. Klyushin's account, is it fair to say that you received a 


Ly tremendous amount of information? 


18 A. Yes, over the course of the investigation, we received a 


19 volume of information. 


11:28 20 Q. But specifically from his iCloud account, you received a 


21 tremendous amount of information; is that correct? 


22 A. There were gigabytes, yes. 


23 Q. You received 130,000 messages? 


24 A. I don't have an exact count, sir. 


25 MR. NEMTSEV: Your Honor, could I approach the 
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alt witness? 


2 THE COURT: Well, does that sound about right? 


3 THE WITNESS: It is possible. We collected a lot of 
4 messages. And to be clear, are you referring to a type of 
is messages? Emails, chats? 


6 Q. Messages, meaning instant messages, SMS messages, iCloud 


. messages, Threema messages, WhatsApp messages. 


8 A. It's possible. There were quite a few. 


9 Q. And the messages that you collected, did they not begin in 


11:29 10 September of 2014 and end in October of 2020? 


11 A. The scope of the warrant would not have covered anything 


12 before a certain time period, but it is possible that the 


13 provider did provide that date range. I don't recall. 


14 Q. Did you also receive 95,000 pictures from Mr. Klyushin's 


15 iCloud account? 


16 A. Again, I know it was in the tens of thousands, but 


Ly recollect an exact number. 


18 : You also received location records, calendar entries 


19 Yes. 


11:30 20 : -—- contact information, correct? 
21 : Yes. 
22 ‘ Call logs? 
23 : That sounds accurate. 
24 ‘ WiFi connection records? 


25 . That's possible. 


11:30 10 
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ife, 


Voicemails, audio recordings? 


It's possible. 


Videos? 


ideos, yes. 


Emails? 
Yes. 


ther documents, including business records that you've 


to evidence? 


And Mr. Klyushin's iCloud, it included pictures of his 


his kids, correct? 


11:31 20 


2] 


Q. 


That is correct. 


It also included messages between his wife and his 


children; is that correct? 


A. 


Q. 


That is correct. 


Sir, isn't it a fact that despite all of the information 


that you obtained from Mr. Klyushin's iCloud, you didn't locate 


a single earnings report or a single picture of an earnings 


report on his iCloud account? 


don't recall finding any prepublication information on 


lyushin's account. 


22 


23 


24 


25 


Q. 


So you found nothing that you would consider suspicious in 


terms of earnings reports or pictures of earnings reports on 


his iCloud; is that correct? 


A. 


No specific pictures on Mr. Klyushin's account, no. 
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i Q. And isn't it a fact that you didn't locate a single 


2 picture including Mr. Klyushin and Mr. Sladkov together? 
3 A. Together, no, but we have discussed some pictures that we 


4 did find. 


5 Ov. But it was not a picture of Mr. Klyushin and Mr. Sladkov 


6 in one picture that was located on his iCloud, correct? 


7 A. We did not, no. 


8 Q. And you didn't find a picture of Mr. Klyushin and 


9 Mr. Sladkov together on any other ones -—-- any other iClouds 
11:32 10 that you searched, correct? 
11 : No, we didn't. 


12 : And you similarly didn't locate any pictures with 


13 . Klyushin and Mr. Irzak, correct? 
14 : No, we did not. 


15 : For that matter, you didn't locate a single picture with 


16 . Sladkov's cohabitant, I believe that you labeled her, 


nny - Olga Opukhovskaya, correct? 


18 : No, we did not. 


19 : Similarly, isn't it a fact that you did not locate a 


11:32 20 Single communication between Mr. Klyushin and Mr. Sladkov? 


21 A. We did not find communications between the two, no. 


22 Q. And am I correct you found no communications between 
23 Mr. Klyushin and Ms. Opukhovskaya; is that correct? 


24 A. No communications directly, no. 


25 Q. And you also didn't locate a single communication between 
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] Mr. Klyushin and Mr. Irzak, correct? 


2 A. We did not find any communications between Mr. Klyushin 


3 and Mr. Irzak, no. 


4 Q. And you testified that you received authorization to get a 


5 pen register and a tap-and-trace device on Mr. Sladkov's 

6 WhatsApp; is that correct? 

7 A. 

8 Q. At the time that the device was active and collecting 


9 information, you still didn't locate any communications between 


11:33 10 Mr. Klyushin and Mr. Sladkov; is that correct? 


11 A. Directly, no. 


12 O% And isn't it a fact that Mr. Sladkov and Mr. Irzak reside 


13 in St. Petersburg? 


14 A. That is correct. 


15 ; . Klyushin, Mr. Ermakov, Mr. Rumiantcev reside in 


16 Moscow; is that correct? 


17 A. Yes, that is correct. 


18 Q. And isn't it a fact that St. Petersburg and Moscow is 


19 approximately 450 miles away? 


11:33 20 A. I don't know the distance, sir. 


21 MR. NEMTSEV: Judge, may I approach the witness? 


22 THE COURT: Yes. 


23 Q. Sir, the document I've handed to you, does that look like 


24 a Google Maps printout? 


25 A. It does. 
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i : And it shows a route from Moscow to St. Petersburg; is 
2 correct? 


3 F It does. 


4 ‘ What's the distance there? 


5 ‘ It's in kilometers. It's 704 kilometers. 


6 ; And do you know the conversion rate from kilometers to 
7 miles? 


8 A. Approximately 2.2. 


9 : Do you have a phone? 


11:35 10 : I do not. 


‘lal ; Is it fair to say 100 kilometers is about 62 miles? 


12 ; Your approximation earlier sounds like it's likely 


13 accurate. 


14 ; So approximately 450 miles, approximately the distance 


15 Boston to Washington, D.C. where your office is, correct? 


16 ; Approximately, yes. 


17 Q. Now, isn't it a fact that you also didn't locate any 


18 communications or emails between Mr. Rumiantcev and the other 


19 individuals that reside in St. Petersburg, including 


11:35 20 . Sladkov, Mr. Irzak, and Ms. Opukhovskaya? 


21 : If you could repeat the question. That was a lot of 


22 names. 


23 Q. Isn't it a fact that you didn't locate any communications 


24 or emails between Mr. Rumiantcev and the other individuals that 


25 reside in St. Petersburg, including Mr. Sladkov; Mr. Irzak; and 
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1 . Sladkov's cohabitant, Ms. Opukhovskaya? 


2 A. That is correct. 


3 Q. And as part of your testimony, you showed us videos, did 
4 you not, of Mr. Ermakov's birthday? 
5 : Yes. 


6 . And that was, I believe, Exhibit 110? 


7 ; I don't know the number, sir. 
8 : The video was taken on April 10th, 2018; is that correct? 


9 . Yes, that's correct. 


11:36 10 . And Mr. Sladkov and Mr. Irzak were not in attendance; is 
11 correct? 


12 : That is correct, but those pictures related to that same 


13 event were sent and communicated with Mr. Sladkov, of the event 


14 of the birthday celebration on the top of the mountain, 


15 helicopter skiing. 


16 Q. And the pictures that you say were communicated to 


Ly . Sladkov -- 


19 : —- they didn't come from Mr. Klyushin, correct? 


11:36 20 : I know that they were transmitted between Mr. Ermakov and 


21 . ladkov. 


22 Q. So those pictures came from Mr. Ermakov to Mr. Sladkov, 


23 COrrect? 


24 A. I don't know where they originated. I know they were 


25 communicated between Mr. Ermakov and Mr. Sladkov. 


11:37 10 


11:38 20 


21 


22 


23 


24 


25 
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Q. 


You also testified concerning pictures of dinners and 


other events that Mr. 


correct? 


A. 


Q. 


Correct. 


And Mr. Sladkov was similarly not in any of 


Klyushin attended 


pictures; is that correct? 


A. 


A. 


March where it was Mr. 


account. So March of 


A. 


Mr. Sladkov, no. 


with Mr. Ermakov, 


Mr. Irzak was not in those pictures, correct? 


Opukhovskaya? 


No. 


Isn't it a fact, 


sir, that the April 10th, 2018 video was 


of the first pictures or videos that 


Together, yes. 


Ermakov and Mr. Ki] 


yushin being toge 


2018. 


t you located of 


ther? 


I believe there was an earlier one in 


Ermakov that we found in Mr. Klyushin's 


And isn't it a fact that Mr. Klyushin only added 


They were close enough 


celebrate a birthday. 


EV: 


JRT: 


EV: 


THE COURT: 


So listen to 


Sustained. 


Move to strike. 


strike it. 


his question. 


Ermakov to his phone book on March 17th, 2018? 


to go helicopter skiing and 


object. Nonresponsive. 


Case 1:21-cr-10104-PBS Document 214 Filed 02/21/23 Page 89 of 161 


11:38 10 


Isn't it a fact 


Isn't it a fact that Mr. Ermakov was only added to 
lyushin's phone book on March 17th, 2018? 


don't have the exact date. 


that the earliest picture that you located 


them two being together was March of 2018? 


March or April of 2018, yes, that's correct. 


And you have no evidence that they knew each other prior 


to March of 2018, 


correct? 


A. I do. They celebrated a birthday together, quite 


of 2018. 


11:39 20 


21 


22 


23 


24 


25 


lavishly, in April 


Ox I said -- no, 


MR. 


N 


THE COURT: 


Q. My question was: 


EMTSEV: 


said you have -- 
Your Honor. 
What's the question? 


You have no evidence that they knew each 


other before March of 2018; is that correct? 


A. The picture in April of 2018 is evidence itself that they 


likely knew each other. 


MR. 


MR. 


MR. 


THE 


F 


N 


F 


C 


EMTSEV: 


RANK: 


OURT: 


ERNICH: 


Objection. 


Objection. Move to strike. 


object to counsel -- 


Excuse me. He disagrees with your 


analysis. What's the next question? 


Q. Is April 


after March or before March? 


A. April is 


after March. 


QO. After March. 
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1 And I'm asking you for a time period before March of 
2 is that correct? 


3 A. Could you repeat the question, sir? 


4 Q. My question is: Did you find any evidence prior to March 


5 of 2018, before March of 2018, that they knew each other? 


6 . Ermakov and Mr. Klyushin, that is. 
7 ; Outside of the birthday celebration, no, sir. 


8 : Isn't it a fact that you didn't locate any contact 


9 information for Mr. Sladkov or Mr. Irzak in Mr. Klyushin's 


11:40 10 tCloud account? Yes or no, sir? 


11 : No, I did not find any. 


12 : And isn't it a fact, sir, that you didn't find the words 


13 DFIN Solution" or "Toppan" in any of Mr. Klyushin's 


14 communications or pictures? 


15 A. No. These are sophisticated actors. 


16 MR. NEMTSEV: Objection. 


17 THE COURT: No, no. Strike that. This is his turn 


18 for cross. So I strike the "sophisticated." 


19 BY MR. NEMTSEV: 


11:40 20 ‘ Sir, you obtained a tremendous amount of IP data, correct? 
21 
22 Q. And some of that data came directly from Mr. iCloud's 
23 account? 


24 THE COURT: Mr. iCloud's account? 


25 : I'm sorry, Mr. Klyushin's iCloud account. 


11:41 10 


11:41 20 


21 


22 


23 


24 


25 
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A. 


apologize. Could you repeat the question? 


Q. Some of the IP data that you obtained came directly 


from Mr 


A. Ye 


Q. Ot 


brokera 


DF 


IP addr 


Is 


contain 


Wa 


Ye 


Wa 


An 


you spe 


that co 


A. 


QO. An 


. Klyushin's iCloud account; is that correct? 


Ss. 


her IP data came from various other sources like 


ge accounts, correct? 


IN and Toppan provided you with a significant number of 


esses; is that correct? 


£ 


n't it a fact, sir, that DFIN produced log files 


ing over 10,000 IP addresses? 

don't have an exact number or even a rough estimate. 
s it more than 100? 

Ss. 


s it more than 1,000? 


don't have an estimate of the number of unique IPs. 


d Mr. Hartvigsen, he testified that he identified f 


cifically 110 IP addresses from 26 different ISPs; is 


Erect ? 


d in fact, sir, not one of those 110 addresses 


overlapped with any IP address used by Mr. Klyushin; is that 


correct 


A. 


2 


don't have that information in front of me, sir. 
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1 ©. [f Mr. Klyushin was directly linked to one of the IP 


2 addresses located on DFIN or Toppan Merrill's server, would you 
3 have put that in as an exhibit, sir? 


4 A. We did put in evidence about the 185 AirVPN IP. 


5 QO. Did you locate a 185 AirVPN IP on Mr. Klyushin's iCloud 


6 account? 
7 A. No, we did not. 


8 Q. Now, sir, a VPN is a service provider, correct? 


9 A. It is, yes. 


11:42 10 Q. You testified about AirVPN. You testified about another 
11 company called StackPath; is that correct? 


12 A. 


c ' 


free services; is that correct? 


13 Q. Those are not 


14 A. I don't know if they offer free services in addition to 


15 their paid services or not, sir. 
16 QO. And in order to use a VPN, you have to create an account, 


Ly correct? 


18 A. Again, I know that for the paid version you do, because 


19 you have to pay for it, but if they offer free services, 


11:43 20 don't know. 


21 : Do you know if StackPath or AirVPN offer free services? 


22 2 I do not. 


23 ; Did you ask StackPath or AirVPN to locate any accounts 


24 them belonging to Mr. Klyushin, Mr. Ermakov, or 


25 : umiantcev? 
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al : StackPath, no. 
2 ‘ And AirVPN? 


3 ; We did not approach AirVPN for that information, no. 


4 ‘ Now, you testified regarding three pictures of earnings 


5 reports that you located on Mr. Sladkov's iCloud account, 
6 correct? 


7 A. Could you please repeat the question, sir? 


8 Q. You testified regarding three pictures of earnings reports 


9 that you located on Mr. Sladkov's iCloud account; is that 


11:44 10 correct? 


12 : you testified that the earliest picture you located 


13 was from October 19th, 2017, and it was located on the account 
14 of Ms. Opukhovskaya; is that correct? 

15 F Could you repeat the date again, sir? 

16 : October 19th, 2017, sir. 


17 : Yes, that's correct. 


18 . And there was an additional picture from February of 2018 


19 you located on Mr. Sladkov's iCloud; is that correct? 


11:44 20 : That sounds correct, yes. 


21 : Isn't it a fact, sir, Mr. Klyushin, Mr. Ermakov, and 


22 Mr. Rumiantcev did not have any brokerage accounts that you 
23 located in existence in 2017? 


24 A. We don't know what other accounts they may have had 


25 outside of the ones we identified, that is correct. 


11:45 10 


11:46 20 


21 


22 
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Q. You did not locate any accounts that they had that were 


open in 2017; is that correct? 


A. We did not locate any other accounts than what we've 


discussed. 


Q. And you also didn't locate any brokerage accounts that 


were open under Mr. Rumiantcev's name, Mr. Ermakov's name, or 


Mr. Klyushin's name in February of 2018; is that correct? 


A. That is correct. 


Q. And isn't it a fact that the first transaction that you 


located being placed in the account of Mr. Klyushin was July 


2018? 


A. That sounds accurate, yes. 


Q. And you would agree that July of 2018 is approximately 


nine months before that you 


£ 


found the first photo in October 


2017 and about five months after the photo that was taken in 


February of 2018? 


[ would agree with that 


three pictures were 


three pictures that 


date -- date analysis. 


t it a fact, sir, that you found no evidence that any 


transmitted to Mr. Klyushin? 


were sent between who? 


Q. You found no evidence that Mr. Sladkov or Ms. Opukhovskaya 


transmitted the pictures that 


23 


24 


25 


Mr. Klyushin; is that correct 


t we just discussed to 


Ee 


A. We identified trading that occurred at the same time. 


Q. Special Agent, I'm not asking you about trading. I'm 
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A asking you about pictures. 


2 You have no evidence that those three pictures were ever 


3 transmitted to Mr. Klyushin; is that correct? 


4 A. Directly to Mr. Klyushin, no. 


5 Q. And you have no evidence that Mr. Klyushin transmitted 


6 those pictures to either Mr. Sladkov or Ms. Opukhovskaya; is 


7 that correct? 


8 A. No direct evidence, no. 


9 Q. Sir, isn't it a fact that the only individual of the five 


11:46 10 that you named here that you allege are criminally responsible, 


11 only one individual had a trading account in 2017; is that 


12 correct? 


13 A. As I indicated before, I have to be careful answering that 


14 question because a lot of these accounts are behind omnibus 


LS accounts. Right? You can't see who the beneficiaries are. 
16 Q. Special Agent, yes or no, did you locate -- 
17 THE COURT: Why don't you ask the question again. 


18 To your knowledge, what you could see. Go ahead. 


19 Q. To your knowledge, what you saw, what you located, what 


11:47 20 you presented as evidence, there was only one individual that 


21 had a trading and brokerage account in 2017; is that correct? 


22 : t least one, that is correct. 
23 : And that individual was Mr. Sladkov; is that correct? 


24 : Correct. 


25 : Sir, you fied regarding a picture of a boat that you 
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al. located on Mr. Sladkov's iCloud account, correct? 


2 ‘ Did you say Mr. Sladkov? 
3 ‘ Yes. 


4 F Yes. 


5 ‘ And that was a picture that was transmitted | 


6 . Klyushin to Mr. Ermakov, correct? 


8 Q. And you testified that there were several other pictures 


9 of boats that were located on Mr. Sladkov's iCloud account, 


11:48 10 correct? 


12 : Isn't it a fact that there's no evidence that Mr. Klyushin 


13 those pictures to Mr. Sladkov; is that correct? 


14 : Not directly, no, that's correct. 


15 : And, in fact, you testified that the pictures were sent 


16 from Mr. Ermakov to Mr. Klyushin, correct? 


17 A. They were in the WhatsApp folder for media items exchanged 


18 between Sladkov and Ermakov, yes. 


- 


19 Q. And you testified that you located a significant amount of 


11:48 20 messages between Mr. Klyushin and Mr. Ermakov; is that correct? 


21 A. 


22 ; And you did not find any message where Mr. Klyushin asks 


23 . Ermakov to submit those pictures to Mr. Sladkov; is that 


24 correct? 


25 A. I did not find that, no. 


11:49 10 
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Q. And you similarly testified that you located a slide deck 


for one of the M-13 products; 


VES. 


is that correct? 


That was also located in Mr. Sladkov's iCloud account? 


VES: 


And isn't it a fact that 


you found no evidence that 


Klyushin asked Mr. Ermakov to send that to Mr. Sladkov? 


found no evidence of that, no. 


You also testified that you located application data for 


the M-13 application on Mr. Sladkov's iCloud; is that correct? 


installed on November 26, 201 


11:50 20 


2] 


A. November 26th? 


2019. 


It was in November of -- 


lking about? 
Mr. Sladkov's iCloud. 


A. No, there was evidence i 


Isn't it a fact, sir, that the application was only 


9? 


actually, no. Whose account are 


t was there as early as September 


of 2019, several weeks after 


ferring to. 


22 


23 


24 


25 


the slide deck you were just 


You reviewed metadata for files associated? 


I have. 


chat application found on Mr. 


Did you review a metadata file associated with the M-13 


Sladkov's iCloud? 
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2 MR. EV: Could we pull up Exhibit 351. 


3 MR. I don't believe this is in evidence. 


4 THE I : Oh, we can't pull it up then yet. 351, 


5 did you say? 


6 MR. ; EV: Yes. 


a ! : I have to check. Sorry. 


8 MR. FRANK: This is not in evidence. 


9 MR. NEMTSEV: And I don't believe that this is the 


11:50 10 exhibit that I requested. Mr. Picard, 351. Could you take 
11 that down, please. 


12 : Isn't it a fact that you found no evidence that 


13 . Sladkov ever used that application? 


14 : I don't believe we had any evidence to show one way or the 


15 other, but we did have evidence that the application was 


16 installed on an Apple device associated with the Sladkov Apple 


Ly account. 


18 Q. And Mr. Frank, on your direct examination, he reviewed an 


19 employee list that you located on Mr. Klyushin's iCloud in 


11:51 20 April of 2020; is that correct? 


21 : I believe it was March. 


22 : Barly 2020; is that correct? 


23 : Barly 2020, yes. 


24 : And that list contains 46 employees; is that correct? 


25 . Could you repeat the number? 
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2 ‘ I believe it was more. Do you have the list? 


3 ‘ Sure. 


4 MR. NEMTSEV: . Picard, could we please pull up 


5 Exhibit 58A. 


6 THE ] J I didn't hear that. 


7 MR. NEMTSEV: 58A. 


8 : Is this the list that you testified about? 


9 , Is there more than one page? 


11:52 10 . NEMTSEV: Mr. Picard, could we turn to the next 


12 THE COURT: Is there another page, can you tell? 
13 : The question -—- was it 47 or -- 
14 : 46 employees related to M-13. 


15 : I would have to count them up since the count is for all 


16 the employees on the list. 


17 : Would you agree that it's more than 20? 


18 : Yes. 


19 F More than 30? 
11:53 20 : Yes. 


21 : Somewhere in the range of 40 to 50? 


22 : £ could review both pages together, I would probably 


23 agree to that. 


24 MR. NEMTSEV: Mr. Picard, could you please pull up the 


25 first page. 
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i THE COURT: This is confusing. It's up on a double 


2 screen here. 


Si MR. NEMTSEV: We're having some technical 


4 ifficulties, Your Honor. 


5 THE COURT: It can't be that difficult. Doesn't it 


6 have the numbers of employees? 


7 MR. NEMTSEV: t does. 


8 THE COURT: All right. So why don't you just ask him. 


9 On the exhibit, what does it say? 


11:53 10 . NEMTSEV: Your Honor, it's 46 employees related to 


12 : The remaining employees are related to a different 


13 company; is that correct? 


14 A. There were two companies listed. Again, I don't have the 


is) exact count, and I can't see, but —- 


16 Q. But fair to say it's about 40 to 50; is that correct? 


17 A. There were dozens of M-13 employees listed, yes. 


18 Q. And as far as you know, those employees were only assigned 


Lf 


19 to one specific project, correct? 


11:54 20 A. As the caption indicated, yes. 


21 Q. And the list contains engineers, IT professionals, other 


22 IT personnel; is that correct? 


23 A. That is my recollection, yes. 


24 Q. Mr. Klyushin was designated the first deputy director 


25 general; is that correct? 


11:54 10 
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corre 


A. 


the s 


ct? 


6-101 


Ermakov was designated a deputy director general, 


Again, that's my recollection. I don't have anything on 


creen here. 


Q. 


direc 


those 


profe 


LO? 


Do you recall that Mr. Rumiantcev was designated deputy 


Isn't it a fact, based on the document alone, none of 


individuals were designated as IT or cyber security 


ssionals? 


11:55 20 


21 


22 


23 


24 


25 


A. 
Q. 
work; 
A. 
somet 


Q. 


The company is an IT company. 


is that correct? 


hing like that. 


You also testified abou 


lyushin's iCloud account 


EMTSEV: Could 


And Mr. Frank asked you 


[ believe their executive role was listed in lieu of 


But they weren't designated as the techs performing the 


t a proposal that was located 


cE, correct ? 


we pull up 141A. 


to read one portion of one page 


proposal; is that correct? 


That is correct. 


Would you agree that it 


"s a very detailed proposal? 


Yes, that was accurately described in that exchange we 
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2 : That it spanned 16 pages; is that correct? 


3 F Yes. 


4 . EV: Mr. Picard, could we turn to the last 


6 : This is the last page of the proposal, correct? 


7 ‘ The red team proposal, which was a penetration testing 


8 proposal, yes. 


9 Q. And it lists four employees that would be assigned to this 


11:56 10 specific contract, correct? 


11 : I see four names, yes. 


12 ‘ Mr. Klyushin, Mr. Ermakov, and Mr. Rumiantcev are not on 


13 list; is that correct? 
14 ; No. There were many employees at the company. 


iS) MR. FRANK: Objection, Your Honor, and I'd ask for a 


16 sidebar. 


A} THE COURT: Well, are you desperate for one right now? 


18 MR. FRANK: This strays into a pretrial ruling, Your 


19 Honor, and I'm concerned that there is a door being opened. 
11:56 20 THE COURT: All right. Let me see you at sidebar. 
21 (SIDEBAR CONFERENCE AS FOLLOWS: 


22 THE COURT: What's the question and... 


23 MR. FRANK: Pretrial, the Court ruled that we could 


24 not introduce th vidence of the FBI poster which identified 


25 Mr. Ermakov as a hacker because 
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al THE COURT: Yeah, but what was the question? 


2 MR. NEMTSEV: The question was there were four 
3 names listed on that document. Mr. Ermakov, Mr. Klyushin, and 


4 Mr. Rumiantcev were not one of the four names. 


5 MR. FRANK: He's attempting to establish that 


6 Mr. Ermakov was not a technical employee. In other words, he 


7 didn't do technical work in his work for M-13. In other words, 


8 he wasn't one of the employees who did the hacking for M-13 


9 when they did the —- 


11:57 10 THE COURT: I do remember why I ruled you couldn't say 


11 that, but I'm not sure why this question invokes that. 


12 MR. FRANK: Because he's establishing that Mr. Ermakov 


13 has an executive title but is not one of the employees who does 


14 the hacking that M-13 does when they do the pen testing. He's 


LS not an employee with the technological expertise 


16 THE COURT: I don't think that intrudes into my 


18 ‘ EMTSEV: asked him about what the document 


19 says, Judge. I didn't ask him -—- 
11:58 20 MR. FRANK: He's misleading the witness. 


21 THE COURT: Overruled. Can I just say -- so 


22 timing-wise let me just say this guy has an amazing memory, 


23 this agent, I mean —- but I don't have a problem with him 


24 having notes to answer some of these questions. I mean, like 


25 some of the ones he says "I don't remember," if he has, like, 
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al 302s or something, I don't care if he needs to refresh his 


2 recollection. 


Si MR. FRANK: It's up to counsel if he wants -—-— 


4 MR. NEMTSEV: 'd prefer him to not have notes. 


5 THE COURT: Okay. I'm just saying some of it is -- 


6 was it in November or September? 


7 MR. FERNICH: Oh, I think he knows the answers. 


8 THE COURT: So far he does. I'll give you that. So. 


9 END OF SIDEBAR CONFERENCE. ) 


11:59 10 BY MR. NEMTSEV: 


‘lal Q. Sir, you testified that the 89.107.124.39 IP address and 


12 the 89.107.124.43 address belong to M-13; is that correct? 


13 : I'm not certain we've got the IP address right. 
14 ‘ 89.107.124.39. 

15 : Yes. 

16 ‘ As well as 89.107.124.43? 

17 : 43 or 42? 


18 . 43. 


19 MR. FRANK: Objection, misstates. 


11:59 20 : 42, would you agree? 


21 THE COURT: You know it's okay if you say, "I 


22 remember exactly." 


23 THE WITNESS: Oh, I do remember. That was the wrong 


24 IP address, ma'am. 


25 THE COURT: Okay. That's the answer. 
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al : 89.107.124.42 belongs to M-13; is that correct? 


2 : Correct. 


3 : And that did not personally belong to Mr. Klyushin, 


4 . Ermakov, or Mr. Rumiantcev; is that correct? 


5 ‘é That is correct. 


6 Q. They were assigned to the M-13 offices and the 


7 addresses -—- address of the office; is that correct? 


8 A. The organization itself, yes. 


9 Q. Isn't it a fact, sir, that every person who was using the 


£ 


12:00 10 Internet from the office would be associated with those IP 


ded. addresses? 


12 : I don't know how it was configured, sir. 


13 : But you would agree, would you not, that in an office 


14 environment where an organization has an IP address, everyon 


LS within that organization who is working from that office would 


16 have the same IP address? 
17 MR. FRANK: Objection, calls for speculation. 


18 THE COURT: Do you know? 


19 THE WITNESS: I don't. 


12:01 20 MR. NEMTSEV: Can we pull up Exhibit 195A. 


21 Q. Sir, this is a document of the files that were downloaded 


22 from the 119.204.194.11 IP; is that correct? 


23 MR. FRANK: This is not the document that was 


24 introduced into evidence. We can call it up on our computer if 


25 you'd prefer. 
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i THE COURT: I could not hear a word you just said. 


2 MR. FRANK: I apologize, Your Honor. This document is 


3 marked "draft." It is not the exhibit that's in evidence. 
4 THE COURT: So where's the exhibit -- what number is 


5 it, the one that was in evidence? Does Ms. Lewis know? 


6 MR. NEMTSEV: 195A. 


7 MR. FRANK: It's 195, and we're happy to call it up if 


8 you don't have it. 


9 THE COURT: Do you want to do that? Is it the same? 


12:01 10 MR. NEMTSEV: Absolutely. 


11 Ms. Lewis, could you please pull it up. Thank you. 


12 THE CLERK: Let me just switch. Just give me a 


13 second. Okay. I've switched. 


14 Q. This is a list of downloads from the DFIN server using the 


15 IP address 119.204.194.11, correct? 


16 A. Correct. 


17 Q. And that was the same IP address that you testified was 


18 located on Mr. Ermakov's iCloud account, correct? 


19 A. It was used for iTunes updates on Mr. Ivan Ermakov's Apple 


12:02 20 account, yes. 
21 ; He updated certain apps, to your memory, correct? 
22 : iTunes. 


23 : Only one update, or more? 


24 < At least one, within four minutes of one of 


25 accesses. 
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alt Q. And isn't it a fact that there's no evidence that 


2 Mr. Klyushin, Mr. Ermakov, or Mr. Rumiantcev traded any of 
i these eight companies in April or May in their accounts? 


4 A. I don't have the trading of their —- 


5 Q. You have no evidence that says that they traded in any of 


6 these companies in April or May in their own names, correct? 


7 A. I didn't analyze the trading for those accounts. 


8 : You did not review brokerage records for Mr. Klyushin, 


9 . Ermakov, or Mr. Rumiantcev? 


12:03 10 : I do not have a recollection of if they traded these names 


12 . NEMTSEV: Could we pull up exhibit -- Ms. Lewis, 


13 can we pull up Exhibit 191A. 


14 Q. And this is a list of downloads from the 104.238.37 


LS range; is that correct? 


16 A. Yes. 


17 Q. And it spans from, I believe, October 22nd, 2018, to 


18 November 8th of 2018; is that correct? 


19 A. Yes, it is. 


12:04 20 Q. And isn't it a fact that that IP range was never located 


2] in Mr. Klyushin's iCloud's account or Mr. Ermakov's iCloud 


22 account or Mr. Rumiantcev's iCloud account? 


23 A. I don't believe it was. 


24 Q. And, sir, would you agree that this is only a list of 


25 companies and documents that was being downloaded? 
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1 A. I don't understand the question. 


2 O.. Meaning, in order to make it onto the summary list that 


3 you introduced into evidence, the file had to be downloaded 


4 from the server of DFIN, correct? 


5 A. Yes, with this download, that ASPX page, being listed. 


6 Q. Do you agree that there were significantly more companies 


7 that were viewed but not downloaded? 


8 A. That is correct. From this IP block; is that the 


9 question? 


12:05 10 . From this IP block and in general, from the DFIN servers? 


11 : Yes, that's correct. 


12 ‘ Is it fair to say about a thousand different companies 


13 viewed or downloaded from DFIN's server? 


14 2 There were a lot. As to the exact number, I don't 


15 é And isn't it a fact, sir, that Mr. Klyushin only | 


16 about 140 of those companies? 


17 A. Yes. We reviewed well, yes. 


18 Q. And you testified that you located a Namecheap account 


19 belonging to Wan Connie that was at one point accessed by one 


12:05 20 of the M-13 IP addresses; is that correct? 


21 A. 


22 : And isn't it a fact, sir, that there's no evidence that 


23 : lyushin, Mr. Ermakov, or Mr. Rumiantcev were the 


24 individuals that accessed that account? 


25 A. We do have evidence that suggests that, sir, yes. 


Case 1:21-cr-10104-PBS Document 214 Filed 02/21/23 Page 109 of 161 


6-109 


1 : You have no evidence that they accessed that account from 


2 IP address on that date, correct? 
3 ; On that day, no. 


4 THE COURT: Well, could you bring us back? Who's 


5 the -- who's Wan Connie the name? Wan Connie? 


6 THE WITNESS: It's one of the Namecheap accounts 


7 associated with the domains we were discussing earlier. 
8 THE COURT: With what company? 


9 THE WITNESS: Namecheap. 


12:06 10 THE COURT: DFIN? 


11 THE WITNESS: No, the Wan Connie account is a separate 


12 but related Namecheap account to the Namecheap accounts that 
13 are associated with the domains that go back to Toppan Merrill. 
14 THE COURT: Toppan Merrill? 


15 THE WITNESS: Correct. And also to DFIN as well 


16 because all of the Namecheap accounts were related. They were 


Ls} overseen by the same individual or group of individuals based 


18 on the evidence that we obtained. 


19 Ox And, sir, isn't it a fact that Wan Connie did not purchase 


12:07 20 any domain that was located on DFIN or Toppan servers? 


21 A. I do not have evidence to suggest that. 


22 MR. NEMTSEV: Ms. Lewis, can we take that down, 


23 please. Thank you. 


24 Q. Sir, you read an article that Mr. Frank showed to you that 


25 was located on Mr. Klyushin's iCloud account, correct? 
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1 A. Do you have more specifics? 


2 Q. It was an article about a hacker that pled guilty and was 


3 sentenced to two and a half years. Do you remember that? 


4 A. Yes, for insider trading. 


5 QO. And isn't it a fact, sir, that Mr. Klyushin has asserted 


6 his innocence and pled not guilty in this case? 


7 MR. FRANK: Objection, Your Honor. 
8 THE COURT: Overruled. 


9 A. Yes, he has pled not guilty. 


12:08 10 Q. And he's been waiting for 22 months to have his case heard 
11 by => 
12 MR. FRANK: Objection, Your Honor. 


13 THE COURT: Sustained. 


14 Q. Sir, you testified that the Threema communications that we 
15 looked at at the last portion of your testimony, they run from 
16 approximately October 2018 to July of 2018 -—- 2019; is that 


Ly correct? 


18 A. That's what we reviewed. If we could pull them back up, 


19 would like to refresh my recollection on the end date. 


12:09 20 ‘ Do you remember when Mr. Klyushin was added to the chat? 


21 : Yes, May 13. 


22 : Of 2019? 


23 2 ight. 
24 : Towards the end of all the communications; is that 


25 COrrect? 
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1 A. Yes, he was referenced throughout the larger collection, 


2 but he was added in May, that's correct. 


3 Q. And prior to May of 2019, the only two individuals in that 


4 group were Mr. Rumiantcev and Mr. Ermakov; is that correct? 


3 ‘ And an unidentified individual in blue. 


6 . But he was added, was he not, on May of 2019? 
7 : That sounds accurate. 


8 : And at that point in time, prior to the addition of 


9 . Ermakov -—- of Mr. Klyushin and the other individual in 


12:09 10 blue, the communications about trading, about profits were 


11 exclusively between Mr. Rumiantcev and Mr. Ermakov; is that 
12 accurate? 


13 A. Those were the two that we were reviewing earlier, yes. 


14 Q. Sir, you testified that Mr. Klyushin was arrested in March 


15 of 2021; is that correct? 


16 A. Yes, March '21. 


LS) : Did you review his trading accounts after March of 2021? 


18 : I didn't personally, no. 


19 ; Are you aware that accounts in his name continued trading 
12:10 20 his arrest? 
21 : There was power of attorney in his accounts, so that would 


22 sense to me. 


23 ; And you have no evidence that Mr. Klyushin, while he was 


24 in custody, had access to a laptop to conduct trades? 


25 A. I have no evidence one way or the other, sir. 
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1 MR. N EV: Ms. Lewis, could we pull up Exhibit 145. 


2 O.. Sir, you fied that this is a letter from Web2Objects, 
3 correct? 


4 A. Yes, I did. 


5 O- And it says, "Web2Objects authorizes Micfo to announce or 


6 readvertise the following IP addresses," correct? 


7 A. Yes. 


8 : And it lists an IP address, 104.238.37, correct? 
9 : Yes. Yes, it does. 


12:11 10 . And it states, "Boston," correct? 


11 : Boston, yes. 


12 : This does not necessarily mean that the IP address was in 


13 Boston, correct? 


14 A. This document -- 


15 MR. FRANK: Object to what it means, Your Honor. 


16 Q. [Is it fair to say that Micfo would have to take additional 


17 steps in order to place this IP address on a server in Boston? 


18 A. 


19 . NEMTSEV: Can we go to Exhibit 176. 


12:11 20 Q. And this is a record from the entity ARIN; is that 


AL correct? 


22 A. 


23 Q. And it's an entity that you testified that it gives out 


24 addresses; is that correct? 


25 A. It does not give them out. It's a registry. So it shows 
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1 who owns what and whom —- to whom these blocks are assigned. 


2 MR. NEMTSEV: Can we go to page 2, please. 


3 ‘ And it says, "On June 18, 2018, Web2Ob jects reassigned 


4 IP range to the following organization," correct? 

5 ‘ June 18, 2018, that's correct. 

6 ‘ And the organization name is Strong Technology, LLC; is 
7 correct? 


8 : It is. 


9 O. And you are aware from your investigation that Strong 
12:12 10 Technology operates a VPN service called StrongVPN? 
‘lal A. That is correct. 
12 Q. And isn't it a fact, sir, that StrongVPN never offered a 
13 server from Boston, Massachusetts, during this relevant time 


14 period? 


15 A. I don't know when they began advertising their services in 


16 Boston, but they did offer services in Boston. 


17 : Sir, are you familiar with the Wayback Machine? 


18 : I am. 


19 : And what is the Wayback Machine? 


12:13 20 : The Wayback Machine is a repository of certain snapshots. 


21 I say "certain" very loosely because I don't know when they 


22 go out and crawl the Internet, but at certain times they obtain 
23 snapshots of certain websites. 
24 Q. Sir, you're aware that StrongVPN has a website; is that 


25 COrrect? 
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1 : I would assume that they do, yes. 


2 MR. NEMTSEV: Madam Clerk, could I have the document 
3 camera, please. Thank you. 


4 MR. FRANK: I object to this being displayed to the 


5 It's not in evidence. 


6 THE COURT: Are you moving it in? 


7 MR. NEMTSEV: ‘ll move it in, Your Honor. 


8 MR. FRANK: I object. The witness hasn't identified 


12:13 10 COURT: Let's see if he can identify it. 
11 MR. FRANK: Well, can we be shown the document without 


12 displayed? 


13 THE COURT: Yes. Can you show it to him. 


14 MR. FRANK: I object on hearsay grounds, Your Honor, 
15 and authenticity. 


16 THE COURT: Well, do you want to show it to him? 


Ly . NEMTSEV: Yeah. 


18 THE COURT: I don't even know what it is. Let's start 


12:14 20 THE WITNESS: I don't either. 


21 A. I see what it appears to be, but I can't attest to the 


22 accuracy or validity of it. 


23 OQ. Sir, do you have any reason to doubt the accuracy of 


24 archives of the Wayback Machine? 


25 A. I didn't pull that document, so I don't know where it came 
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al from, sir. 


2 Q. Do you have any reason to doubt the accuracy of the 
i) Wayback Machine, sir? 
4 MR. FRANK: Objection, asked and answered. 


5 THE COURT: No. Sustained. It's sustained. You'll 


6 have to do it a different way. 


7 : EMTSEV: Your Honor, I'd move to introduce these 


9 MR. FRANK: Object, Your Honor. 


12:15 10 THE COURT: Sustained, if he doesn't know what they 


12 . NEMTSEV: Madam Clerk, could we please have 


13 Ms. Lewis's computer again. Thank you. 


14 THE CLERK: Yeah, I can switch back. Mm-hmm. Okay. 


15 Switched. 


16 MR. NEMTSEV: "d like to bring up Exhibit 142. 


17 Madam Clerk, it doesn't seem to be working. 


18 MR. FRANK: Is this in evidence? 


19 THE CLERK: It's up on my end. 


12:16 20 MR. NEMTSEV: Yes, this is -—- can everybody see this 


21 document? 


22 THE CLERK: I switched. Do you want me to go back to 


23 the government's? 


24 MR. NEMTSEV: Okay. 


25 : This is a contract between Markley Boston and Micfo, LLC; 
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al: correct? 


2 : [It is. 
3 Q. And the contract, to your knowledge, is to lease space in 
4 Markley's building, correct? 


3 yee In Boston, yes. 


6 Q. It's not a contract to lease any sort of server; is that 


7 correct? 
8 A. That is correct. 


9 Q. And is it your understanding that Micfo was renting a 


12:16 10 cabinet from Markley in which it was going to place one of its 


Aa. own servers? 


12 A. I don't recall what it was going to place there, but 


13 know it was a contract for real estate within the Markley 


14 datacenter here in Boston. 


15 MR. NEMTSEV: Can we turn to page 7, please, 


16 Ms. Lewis. 


17 THE CLERK: I have it on your side. So if it works -—-— 


18 MR. NEMTSEV: Perfect. Thank you. 


19 Q. And the contract is signed by Amir Golestan, do you see 


12:17 20 that, on behalf of Micfo? 


AL A. Yes. 


22 Q. And you are aware, are you not, that Mr. Golestan, at the 


23 time, was the owner of Micfo, LLC? 
24 A. 


25 Q. And you've previously shown us that the invoices from 


12:18 10 


12:18 20 


21 


22 


23 


24 


25 
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October 2018, the invoices from Markley to Micfo, were paid, 


correct? 


A. Those were StackPath invoices I believe we were looking 


Did you, sir, not testify about any Markley invoices? 


Could you refresh my memory on what we're referring to? 


Would you agree, ultimately, that Micfo did not live up to 


financial commitments to Markley? 


I have no evidence to suggest that. 


MR. NEMTSEV: Could we turn to page 13, please. 


Ox This is a letter to Micfo, LLC, from July 10th, 2019, is 


it not, sir? 


A. At the very end of the relationship, yes. I misspoke. 


Yes, at the very end, they stopped paying for services. This 


was in the 2019 time frame, based on the letter, not during the 


time period in question. 


QO. The letter advises that, "As of the date of this letter, 


your account is severely overdue"; is that correct? 
A. That is correct. 


O. "As of the date of this letter, your account is $9,573.92 


overdue"; is that correct? 


A. That is what it says. 


NEMTSEV: Can we turn to the next page, please. 


Q. this is an additional invoice. The statement is dated 


August 20th, 2019; is that correct? 
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al : Yes, 2019, that's correct. 
2 : And, again, there's a balance due that's $14,185.88; is 
3 correct? 


4 : For services in 2019, that's correct. 


bs F And the first invoice that was unpaid was April 1, 2019; 


6 is that correct? 


7 A. That's what it appears to be, yes. 


8 Q. Sir, do you know if Micfo ever compensated Markley for its 


9 overdue invoices? 


12:19 10 A. From 2019, no, I never investigated that. 


11 Q. Sir, isn't it a fact that Micfo and its owner, Amir 


12 Golestan, were convicted in a federal court of fraud in 


13 connection with conduct that occurred between February 2014 and 


14] May 14th, 2019? 


15 A. Unrelated to the services rendered to StackPath. 


16 Ox Isn't it a fact? 


17 THE COURT: Is that a "yes"? 


18 THE WITNESS: There was a conviction in 2019. 


19 Q. For conduct that occurred between February of 2014 and May 


12:20 20 of 2019? 


21 A. I have no knowledge of the exact date -- date, time 


22 related to the offenses. 


23 Q. f represent to you that the conduct was between 


24 February 2014 and May of 2019 -—- 


25 A. I don't know, sir. I have no idea. 


12:20 10 


12:21 20 


21 


22 


23 


24 


25 
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Q. You've never looked at any of the Micfo documents related 


to the c 


onviction? 


A. I do not recall the date range of fenses that you 


are refe 


rring to, sir. I don't. 


Or. You also testified about a picture of a server at Markley; 


is that 


A. 


correct? 


Q. And the server had a little tag beginning with the letters 


ist 


hat correct? 


Yes: 


And you don't know what ST stands for, do you? 


do not know specifically, no. 


You guessed that it stands for StackPath; is that correct? 


the manu 


A. Tt 


Q. ae 


is that 


Yes 


ST 


Yes 


s possible it stands for StackPath. 


s also possible that it's an internal designation by 


facturer of the server; is that correct? 

is possible. 

s also possible that it relates to Strong, StrongVPN; 
correct? 

, that's possible. 


could relate to absolutely anything, correct? 


, that is possible. 


MR. NEMTSEV: Can we please pull up Exhibit 140. 


QO. The 


correct? 


se are the Micfo invoices that you testified about, 
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1 A. This appears to be one of them, yes. 


2 Q. And Micfo is a company that owns the server equipment on 


3 which the 104 IP address may or may not have been placed? 


4 A. We have evidence that suggests that it, indeed, was placed 


bs there. 


6 Q. You would agree, wouldn't you, that the 104 IP address 


- only accessed DFIN servers from approximately October to very 
8 early November; is that correct? 
9 . This 104 block? 


12:22 10 . Yes. 


11 : Accessed the filing agent, yes. 
12 : October to November is the time period that we're 
13 concerned with, correct? 


14 A. Correct. 


15 MR. NEMTSEV: Mr. Picard, can we go a little lower. 


16 Yeah, down. Further down, to the November 24, 2018 invoice. 


17 Should be Exhibit 140. 


18 Q. You testified that the earliest invoice, it's a November 


19 2018 invoice, correct? 


12:22 20 : What is on the screen? 
21 Q. On the screen is a June 24th, 2019 invoice. Do you see 


22 that? 


23 A. I do. What was your question? 


24 Q. The earliest invoice that you located featuring this 


25 range was from November 24, 2018; is that correct? 
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dL: A. Yes, I believe that's correct. 


2 0. And that was an invoice to host this IP range from 


3 December 1, 2018, to December 31st, 2018; is that correct? 


4 A. [ believe there was one that referenced a time period that 


5 spanned in the second or third week of November. So that would 


6 predate the date range you just referenced. 


. Q. The time period was the November 24 invoice was the 


8 of the invoice. It was not the date of the time period 


9 was listed? 


12:23 10 ‘ Do you have it? We could take a look at it. 


11 MR. NEMTSEV: Mr. Picard. 


12 : Is this the invoice that you recall testifying about? 


13 : Yes, this is one of them. 


14 . And it's an invoice dated November 24th, 2018, with the 


15 range 104.238.37, correct? 


16 A. That is correct, yes. 


17 Q. And the dates of service are December 1, 2018, to December 


18 2018, correct? 


19 : That is correct, yes. 


12:24 20 : And the location is listed as Boston, correct? 


21 : That is correct, yes. 


22 : And it's listed as the server is listed as U-O7; is 
23 correct? 


24 : Number 7, yeah, that is it, sir. 


25 : And this invoice doesn't say anything directly about where 
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al IP or the server were in October of 2018, correct? 


2 ‘ It does not say, no, it doesn't. 


3 Q. And you testified that you'd not located an earlier 
4 invoice, correct? 
5 A. Yes, certain record retention policies, they provided what 


6 they could find. 


7 Q. You testified that you couldn't find an invoice earlier 


8 than this one associated with this IP range, correct? 


9 A. Correct. 


12:25 10 Q. But you did receive invoices from StackPath that were 
11 earlier in time than this, correct? 
12 A. That is accurate. 


13 Q. And you received, did you not, sir, invoices earlier than 


14 November of 2018 indicating that the U-0O7 server was dedicated 


15 to a different IP address? 


16 THE COURT: When? 


17] MR. NEMTSEV: Prior to November of 2018. 


18 : It is possible. 


19 MR. NEMTSEV: Madam Clerk, could I please have the 


12:25 20 document camera. 


21 THE CLERK: Yes. 


22 Q. This is another invoice that you received from StackPath; 


23 is that correct? 


24 MR. FRANK: It's not in evidence, Your Honor. 


25 MR. NEMTSEV: "ll move it in as Exhibit 416. 


12:26 10 


12:27 20 


21 


22 


23 


24 


25 
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THE CLERK: 416? 


MR. NEMTSEV: Yes. 


Exhibit 


No. 416 received into evidence.) 


u see that invoice, sir? 


And this is an invoice dated October 25th, 2018, correct? 


October 25th, 2018, yes. 


And it specifi 


correct? 


A. 
Q. 


2018, 


It does. 


fies an IP range of 104.156.206; is that 


And it specifies that between the period of November 1, 


to November 


30th of 2018, this was going to be the IP 


address that was going to be located on server space 7. 


Q. 


Do you see that? 


see that, yes. 


And StackPath produced to you additional invoices, did it 


relating to this IP address and its location on server 7? 


don't know. 


You would agree that this IP range is not the one that 


we're concerned about, the one that accessed DFIN's servers, 


correct? 


A. 


That is correct. I was searching for the IP range in 


question. 


MR. NEMTSEV: Your Honor, I would move this in as 


Exhibit 417. 


12:27 10 


12:28 20 


21 


22 


23 


24 


25 
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Q. 
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THE COURT: All right. 


(Exhibit No. 417 received into evidence.) 


THE CLERK: The next one? Because I just gave you 


NEMTSEV: Yes. Can I have 417? 


CLERK: Mm—-hmm. 


MR. NEMTSEV: Thank you. 


This is another invoice, this one dated July 25th, 2018. 


Do you see that? 


TF do: 


And it contains the same IP range that we just discussed, 


04.156.206; is that correct? 


A. 
Q. 
and A 
A. 
Q. 
going 
A. 
serve 
Q. 


A. 


It does. 


This is an invoice for services between August 1, 2018, 


ugust 31, 2018; is that correct? 


Correct. 


And it lists, again, that this is the IP address that's 


to occupy server 7, correct? 


It is a range that is going to be associated with that 


r, yes. 


And this invoice is marked as paid, correct? 


Correct. 


"d move to admit Exhibit 418. 


think we just did that, didn't we? 


That was 417. 
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al MR. NEMTSEV: 417, Your Honor. This is 418. 


2 THE COURT: 418. All right. 


3 (Exhibit 418 received into evidence.) 


4 : This is another invoice dated August 25th, 2018, correct? 


5 ‘ It is, yes. 


6 . And, again, this features the IP block 104.156.206, 


7 correct? 


8 : It does, yes. 


9 Q. This one is to provide services between September 1, 2018, 
12:29 10 and September 30, 2018, correct? 


Ved. A. Correct. 


12 Q. And, again, it lists this IP address being associated with 
13 server 07, correct? 
14 A. That is correct. 


15 THE COURT: So as I understand it, there are different 


16 104 IP addresses, some of which were associated with the 


17 intrusion, but some of which are not? 


18 THE WITNESS: That is correct, yes, ma'am. 


19 Q. And the ones that are unassociated with the intrusion, 


12:29 20 according to these invoices, were located on the U-7 server 


21 between September 1 and September 30th and between November 1 


22 and November 30th, correct? 


23 A. That's what the invoices suggest, yes. 


24 THE COURT: And just remind us, where did the 104 


25 track back to? 


12:30 10 
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access to a DFIN employee's comprised -—-— 


track back to? Was that 


THE COURT: But whom did the allege 


THE WITNESS: The -- 


THE COURT: Who owned it? 


THE WITNESS: The 104 came back to 


VPN provider. 


12:30 20 


21 


22 


23 


24 


25 


Q. 


THE COURT: To a VPN provider? 


THE WITNESS: Yeah. I apologize. 


6-126 


s —-- unauthorized 


d intruding 104 


StackPath, so toa 


THE COURT: And that's where it stops? 


THE WITNESS: As far as who owns it 


THE COURT: Thank you. 


BY MR. NEMTSEV: 


And you have no evidence that that same 


located in Mr. Klyushin's iCloud account? 


A. 


We did not find that IP address in Mr. 


account, no. 


Q. 


, that's correct. 


IP range was 


Klyushin's iCloud 


And you did not find that IP range in Mr. Ermakov or 


Rumiantcev's iCloud account; is that cor 


That is correct. 


rect? 


You testified that the first person that Mr. Klyushin's 


correct? 


A. 


Yes. 


ife sent a message to following his arrest was to Mr. Ermakov, 
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1 O.. And you put a tap on Mr. Klyushin's wife's WhatsApp; is 


2 that correct? 


i A. A pen-trap, the caller ID. 


4 Ox And you would agree, would you not, sir, that Mr. Klyushin 


5 was arrested without notice while he was going on a family trip 


6 with his wife and his kids? 


7 A. He was wanted by U.S. authorities, that's correct. 


8 Q. And Ms. Klyushin, Mr. Klyushin's wife, she contacted many 


9 people, correct? 


12:31 10 A. The first person she contacted was Ivan Ermakov. 
11 Ox On her WhatsApp. 
12 What about her instant messages? 


13 F I don't know. 


14 . Do you know who she called? 


15 : I do not. 


16 : Special Agent Hitchcock, is it fair to say your job 


17 involves interviewing individuals and witnesses in connection 


18 with your investigations? 


19 A. That is a piece of it, yes. 

12:32 20 Q. in interviewing witnesses, you take notes; is that 
21 correct, sir? 
22 


23 : you were taught the importance of keeping accurate and 


24 detailed notes at the FBI Academy? 


25 A. 
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1 : that's because you may be a witness in a criminal 


2 that correct? 


4 QO. Fair to say that you try to capture as much as of the 


5 conversation in the statement as you can? 


6 : It depends on the situation, sir, but, yes, I take notes. 


7 : In this instance, you interviewed Mr. Zorek on September 
8 2022, correct? 
9 : That sounds approximately the date. 
12:32 10 Ou And, to your knowledge, you kept accurate and detailed 
11 notes of the interview? 
12 A. Not every word that was spoken. 
13 Q. You later put your notes into a memo; is that correct? 


14 MR. FRANK: I object to this line unless there's a 


15 proffer about where we're going with this. 


16 THE URT: Well, what's the question? 


17] MR. ‘IMTSEV: The inconsistent statement between 


18 JRT: I know. Well, ask him. 


19 : IMTSEV: Could I show him the notes, Your Honor? 


12:33 20 JRT: Yeah. 


21 MR. IMTSEV: Thank you. 


22 THE JIRT: Maybe show Mr. Frank where you're going 


23 with this too. 


24 MR. FRANK: There's no inconsistent statement, Your 


25 Honor. We object. 


12:34 10 
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Well, why don't you ask -- this is only 


for purposes -—- not for the truth of it, but whether or not 


this is inconsistent or not. I'll let the jury's memory 


control as to what was said. 


THE WI] 


[TNESS: 


Do we have an unredacted version of the 


EV: 


that's relevant. 


MR. FERNICH: 


COURT: 


W 


ITNESS: 


COURT: 


Wi 


[TNESS: 


COURT: 


FRANK: 


THE COURT: 


The portion that's unredacted is the one 


Give him the whole thing. 
Well, do you have your own notes here? 
Not in front of me, no, ma'am. 


nean in the room. 


Do you have the full notes, either of you? 


Not sitting right here right now, Your 


So what's the guestion? And if he can't 


answer it based on the redactions, then that's the answer. 


12:34 20 


2] 


QO. There's a 


red flag? 


22 


23 


24 


25 


BY MR. NEMTSEV: 


difference, correct, between an anomaly and a 


A. Let me refresh my recollection here --— 


THE COURT: 


THE WI] 


[TNESS: 


Just read it. Take your time. Read it. 


I would like to see the rest of the 
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i THE COURT: Well, I haven't heard the question yet. 


2 So what's the question? 


3 Q. There's a difference between an anomaly anda red | 


4 there not, sir? 


5 A. It depends on the context. I would like to see the rest 
6 of my notes. 


7 THE COURT: Do you have the full version? 


8 MR. NEMTSEV: believe Mr. Picard may have them, Your 


12:35 10 : Are you almost done with this exam? 


11 : IMTSEV: Very close. 


12 JRT: What? 


13 MR. IMTSEV: Very close, Your Honor. 


14 THE RT: While he's looking for it, can you 


15 to another topic? 


16 MR. NEMTSEV: Of course. 


17 THE COURT: So we don't waste time. Thank you. 


18 Q. Sir, you testified, did you not, that you reviewed 


19 M-13 website only after Mr. Klyushin's arrest? 


12:36 20 A. That is correct. 


21 Q. And is it your understanding that other members of your 


22 team, Similarly, did not review the M-13 website until after 


23 Mr. Klyushin's arrest? 


24 A. Yes, that's correct. 


25 Q. And Mr. Klyushin was arrested on March -- in March of 
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al 2021, correct? 


2 A. That's correct. 


3 Q. And you testified that Special Agent Kang co-led the 
4 investigation with you, correct? 


3 A. Correct. 


6 Q. And Special Agent Kang submitted certain affidavits, did 


7 he not, in connection with search warrants? 


8 A. Correct. 


9 MR. NEMTSEV: May I approach the witness, Your Honor? 


12:37 10 THE COURT: Yes. 


11 : Sir, do you see that that is a January 29, 2021 affidavit 


12 Special Agent Kang? 


13 : It appears to be. 


14 : Signed under the pains and penalties of perjury? 


15 : It appears to be signed. 


16 THE COURT: Have you seen this before? 


17 THE WITNESS: This particular printout? No. 


18 2 You have seen affidavits in 


19 MR. FRANK: This is not his affidavit. 


12:37 20 : I have, but I have not seen this particular printout. 


21 t know where this came from, other than I assume it was 


22 ted out. 


23 THE COURT: This isn't his affidavit. So what's the 


24 question? 


25 Q. Would you turn to the page with the orange sticky, and can 


Case 1:21-cr-10104-PBS Document 214 Filed 02/21/23 Page 132 of 161 
6-132 


1 you read Section 9A. 


2 THE COURT: To yourself. 


3 : To yourself. 


4 . EMTSEV: Thank you, Judge. 


6 Q. Isn't it a fact, sir, that in this January 29, 2019 


7 affidavit -- 


8 MR. FRANK: Objection to reading the affidavit, Your 


9 If he has a question about that —- 


12:38 10 THE COURT: Do you have a question? 


11 MR. NEMTSEV: Yes. Special Agent Kang specifically 


12 and explicitly -- 


13 MR. FRANK: Objection. 


14 THE COURT: I don't know what you're going to say, so 


15 I should see it. 


16 MR. NEMTSEV: -- refers to -- 


17 THE COURT: No. Let me see it. 


18 MR. FRANK: I haven't seen it either. 


19 (SIDEBAR CONFERENCE AS FOLLOWS: 


12:39 20 THE COURT: What are you looking at, Mr. Nemtsev? 


21 MR. NEMTSEV: He testified that no one on his team 


22 reviewed this website until after Mr. Klyushin's arrest. 


£ 


23 Special Agent Kang quotes from this website and specifically 


24 says, according to M-13's website, the company -- 


25 THE COURT: All right. So just ask if this refreshes 
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1 his recollection. That's not a big deal. All right. How much 


2 longer do you have? Mr. Nemtsev —- 


3 2 IMTSEV: Yes. 


4 : —- about how much longer do you have? 


5 ‘ IMTSEV: Ten, 15 minutes, Judge. 


6 THE COURT: What's —- did you find -—- I don't want to 


7 bring him back here just for a little snippet. Did you find 


8 his notes? 


9 MR. FERNICH: I have it digitally. 


12:40 10 THE COURT: Why don't you show us what this is all 


ded. I don't have to come back here a second time. 


12 . FERNICH: All right. So in the 302 that he wrote 


13 a week later, he wrote the words "red flag," and in his notes 


14 of the meeting, he wrote "anomalies." That's all. 


15 MR. FRANK: There's no inconsistency, Your 


16 MR. FERNICH: No, it's for bias and motive. 


£ 


Ly being offered 


or an inconsistency. 


18 MR. FRANK: That's what he offered it for, 


19 inconsistent statement. 


12:40 20 THE COURT: Why it is a bias or a motive? 


ZA MR. FERNICH: Because he changed the word -—- as 


22 started to lay the foundation with Zorek yesterday, he changed 


23 the word in his notes from "anomalies" to "red flags" a week 


24 later when he typed it up. Straight up bias and motive. 


25 MR. FRANK: The witness testified that he used the 
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1 word "red flag." 


2 MR. FERNICH: No. The witness testified that he 


3 couldn't remember. 


4 THE COURT: Ask him what he said. 


5 what Zorek said, but ask him what he said. 


6 MR. FERNICH: That's fine. 


7 THE COURT: All right. I'm going to let you do it. 


8 If it's ten or fifteen minutes, how much longer do you have 


9 on -- 


12:41 10 MR. FRANK: I'll have probably a ten- or 


1] fifteen-minute redirect. But what I'm wondering is whether we 


12 can get Ms. Shah in and out so that she can go back home. 


13 THE COURT: Not if we're at five of 1:00, 


14 unfortunately. 


15 MR. FRANK: Her testimony is going to be brief. 


16 Otherwise, she has to spend a whole night here. 


17 THE COURT: It's warm today. 


18 END OF SIDEBAR CONFERENCE. ) 


19 BY MR. NEMTSEV: 


12:41 20 Q. Sir, does Agent Kang's affidavit refresh your recollection 


21 regarding whether agents or anyone else in the F team 


22 reviewed Mr. Klyushin's company's website prior to his arrest? 


23 A. I don't know the underlying basis for the -- 
24 THE COURT: Do you know one way or the other? 


25 THE WITNESS: E don’t. 
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1 THE COURT: All right. Next question. 


2 0: ir, you asked to review your notes of Mr. Zorek's 


3 interview, correct? 


4 A. Yes, sir, I did. 


5 . NEMTSEV: Mr. Fernich, could you please —- thank 


7 I approach, Your Honor? 


8 THE COURT: Yes. 


9 . NEMTSEV: Thank you. 


12:43 10 : I've got 16 pages here. May I review surrounding -- 


11 THE COURT: Could you give him -- the big question is 


12 focused on two specific three specific words. Why don't you 
13 show it to him. 


14 THE WITNESS: The circled portion? 


LS MR. NEMTSEV: This portion, yes (indicating), and this 


16 portion. 


17] THE WITNESS: { could ask the Court to review some 


18 of the surrounding pages of notes to ensure that -- 


19 THE COURT: Yes, you can, but I think he's only asking 


12:43 20 you about a snippet. 


21 MR. NEMTSEV: Your Honor, maybe I can ask him to read 


22 that portion out loud. It's one sentence. 


23 THE COURT: Let him orient himself. 


24 MR. NEMTSEV: Thank you, Judge. 


25 . Could you repeat the question, please? 
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1 THE COURT: Okay. He's ready. 
2 Q. Your notes say "anomaly" when your memorandum says "red 
3 flags" —- 


4 MR. FRANK: Object to the reading of the notes, Your 


6 THE COURT: Excuse me. Why don't you -- are you at 


7 the point where it says the word "anomaly"? 


8 THE WITNESS: I am, and I'm also looking at page 7, 


9 and it says "monitoring flagged accounts for potential market 
12:44 10 abuse." 
11 THE COURT: All right. So now what's the question? 


12 Q. The question is: Page 15, directly, is associated with 


13 page 5 of your notes, correct, of your memorandum? 


14 A. Page 7 and page 15 appear to be referring to the exact 


15 same period of time. Do you understand what I'm saying? 


16 THE COURT: In your own words, what does anomaly mean? 


17 THE WITNESS: An anomaly is something that is 


18 suspicious, and monitoring it was flagged -- flagging it -- 


19 THE COURT: So that's what his understanding of the 


12:45 20 word means. 


21 Q. Suspicious, but a red flag? 


22 A. On page 7 of 16 pages of notes, I wrote "monitoring 


23 flagged accounts for potential market abuse." On page 15, "a 


24 few trades" 


25 MR. iV object to the reading of the 
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1 ; of the notes. I'm sorry. 


2 COURT: I mean, you've asked him. 


3 WITNESS: You opened the door, sir. 


4 . NEMTSEV: object, Your Honor. 


5 . FERNICH: Objection. There's a judge in the 


6 courtroom. This is the second time now. 


7 MR. FRANK: I object to Mr. Fernich objecting to —- 


8 THE COURT: This has been so nice. We're just going 


9 to leave it alone -—- 


12:46 10 MR. FERNICH: We have a judge who instructs jurors on 


11 I object 
12 MR. FRANK: Objection, Your Honor. 


13 THE COURT: I do —-- all right, let's just -—- now 1] 


14 forget where we were. So you had said that you had flagged 


15 certain trades as suspicious. And then on the other page, what 


16 did you say? 


LS) THE WITNESS: So if the Court will allow it, 


18 from page 7, the snippet that also 


19 MR. FERNICH: Objection. Objection. 


12:46 20 THE COURT: No, no. Then you said something about an 


£ 


21 anomaly later on. What were you referring to? 


22 THE WITNESS: This same reference on page 7. 
23 THE COURT: That's the end of it. What's the next 


24 question? 


25 MR. N EV: Nothing further, Your Honor. 
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1 THE COURT: Nothing further. All right. 


2 REDIRECT EXAMINATION 


3 BY MR. FRANK: 
4 Q. What was it you were going to read, Special Agent? 
5 MR. FERNICH: The documents should be returned. 


6 They're not in evidence, and we'll conduct the examination. 


7 MR. FRANK: It's my redirect. 


8 THE COURT: The document will be returned, but he's 


9 allowed to put in context. 


12:47 10 MR. FERNICH: And he's going to read the 


Ac. document. 


12 THE COURT: Excuse me, Mr. Fernich. Please sit down. 
13 All right. You're doing redirect. Now, what is —- he 
14 can't just read. 

15 MR. FERNICH: No, that's why we should have the 

16 document back. 


17 THE COURT: Excuse me. What is the question? 


18 BY MR. FRANK: 


19 OQ: Special Agent, does that document refresh your 


12:47 20 recollection about what you wrote about Mr. Zorek's interview? 


21 MR. FERNICH: Objection. 


22 THE COURT: Overruled. 


23 A. It does refresh my recollection. 
24 Q. Without looking at the document, could you tell the jury 


25 about what you recorded about Mr. Zorek's interview? 
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1. A. Mr. Zorek provided that the accounts in question were 


2 flagged for potential -—- "flagged" being the key word —- for 


3 potential market abuse. 


4 THE COURT: All right. Next question. 


5 Q. Did Mr. Zorek tell you there were red flags in the 


6 account? 


7 A. 


8 Q. You were asked some questions about a server in Boston. 


9 Do you recall those questions? 


12:47 10 - I do. 


11 , Can a server host multiple IP addresses? 


12 MR. NEMTSEV: Objection. 


13 THE COURT: Overruled. 
14 A. Yes, it can. 


is) QO. So the fact that a server hosts one version of a 104 


16 doesn't mean that it can't also host another version of 


Ly I correct? 


18 2 That is correct. 


19 : What did StackPath -- 


12:48 20 THE COURT: Can a slice of a server serve you know, 


21 I'm thinking a slice of pie. Right? Can a slice of a server 


22 serve more than one IP address? 


23 THE WITNESS: Well, the point of the slice is to be 


24 able to do things like, say, slice number 1 is this IP block, 


25 and slice number 2 would be another IP block. That is -- 
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2 THE COURT: So if you have slice number 7 —-- 


3 THE WITNESS: Well, 7 is a dedicated server that has 


4 slices inside of it. So it is very possible that server number 


6 THE COURT: Do you know that, one way or another, as 


- to how many IP addresses slice 7 served? 


8 THE WITNESS: I don't know specifics. 


9 Q. But you know that it was used for multiple IP addresses, 


12:48 10 correct? 

11 A. Yes. 

12 Q. Okay. And you were asked some questions —- well, 

13 withdrawn. 

14 What do you know about StackPath's document retention 


LS policy? 


16 A. It was three years. 
17 Q. And when did you ask for these invoices? Was it more 


18 three years? 


19 - It was. 


12:49 20 : So they had some documents but not others? 


21 A. Correct. Some were attached to emails, for instance, 


22 not retained in other places, or they were in a file store 


23 rather than email. 


24 QO. You were asked some questions about whether there was any 


25 evidence of the 104 Boston IP address in Mr. Klyushin's iCloud 
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al. account. 


2 Do you recall those questions? 


3 < I do. 


4 . FRANK: Could we look at Exhibit 195A, please. 


5 CLERK: Hold on. I have to switch up. 


6 . FRANK: Oh, sorry, Ms. Molloy. 


7 CLERK: It's okay. You should be reconnected now. 


8 MR. FRANK: Is this 195A? Sorry, I'm looking at -- 


9 . I apologize. 


12:49 10 Ou What is 191? 


11 A. This is the 104.238.37 Boston IP block accessing the Julie 


12 Soma DFIN account to download certain MNPI before it was 

13 released. 

14 MR. FRANK: Could we call up 195A next to it, please. 
15 Q. Now, you recall you were also asked about these downloads 


16 from the 119 IP? 


17 A. 


18 Q. And these were downloads from the 119 IP four minutes 


19 after Mr. Ermakov used that IP address? 


12:50 20 : That's correct. 


21 : And this was in May of 2019, correct? 
22 : Correct -—- or May of 2018. 


23 : 2018. There's a typo in the heading, but on the let 


24 said May of 2018? 


25 A. Correct. 
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1 O. And Mr. Nemtsev asked you whether Mr. Klyushin traded in 


2 those particular stocks. 


3 Do you recall that question? 


4 MR. NEMTSEV: Objection. That's misstating my 


5 question. I asked whether he traded in April and May, those 


6 stocks. 


7 THE COURT: All right. So let's —- 


8 Q. Do you recall being asked if Mr. Klyushin traded in those 


9 stocks? 


12:50 10 A. T do. 


11 MR. NEMTSEV: Objection, Your Honor. 


12 THE COURT: Overruled. 


13 Q. Mr. Klyushin didn't open his brokerage account until two 


14 months later, correct? 
15 A. That is correct. 


16 Q. Okay. But if we look at 191 on the left, that same Julie 


17 Soma user ID was used to download documents via the 104 IP, 


18 correct? 


19 A. That is correct. 


12:51 20 Q. Looking at that list, Mr. Klyushin did trade in those 


21 stocks -—- some of those stocks, correct? 
22 A. That is correct. 


23 Q. For example, Capstead Mortgage, we see it right there on 


24 first page, Mr. Klyushin traded, in October of 2018, in 


25 shares of Capstead Mortgage, correct? 


12:51 10 


12:52 20 


21 


22 


23 


24 


25 
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Correct. 


Elsewhere in this document there's reference to Tesla and 


documents being downloaded? 


That's correct. 


Did Mr. Klyushin trade in those stocks at that time? 


He did. 


MR. FRANK: You can take that down. 


You were asked some questions about the M-13 89 


Do you recall those questions? 


T do. 


Q. And you were asked whether that IP address personally 


belonged to Mr. Klyushin. 


Do you recall that? 


id M-13 belong to? 


lyushin. 


You were asked some questions about whether you found 


evidence of the AirVPN 185 IP on Mr. Klyushin's iCloud account. 


Do you recall those questions? 


E.:d6:s 


What did you learn about the connection between the AirVPN 


IP and the hack? 


That it was observed by Toppan Merrill in the hack. 


MR. FRANK: And could we have Exhibit -- 


And did you also —-- what did you learn about the use of 
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a. the 185 IP in connection with the M-13 89 IP? 


2 A. On January 29th of 2020, it was accessed the AirVPN I 


3 was accessed by way of the M-13 IP address on January 29th. 


4 Q. And what did you learn about who used that same M-13 89 


5 one hour and 41 minutes before the M-13 89 IP accessed the 


6 AirVPN IP? 


7 A. Mr. Klyushin accessed his Russian Standard Bank account. 


8 Q. You were asked some questions about whether there were any 


9 accounts with AirVPN in the names of Ivan Ermakov or 


12:53 10 Mr. Klyushin. 


11 Do you recall those questions? 
12 A. Yes: 
13 Q. Special Agent, you've investigated sophisticated hackers 


14 throughout your career? 


LS MR. NEMTSEV: Objection. 


16 THE COURT: Sustained. 


ay Q. Would you have expected to find accounts in their personal 


18 names? 


19 MR. NEMTSEV: Objection. 


12:53 20 THE COURT: Sustained. 


21 O% Did you find accounts in the name of Andrea Neumann at 
22 Namecheap and at BitLaunch and at other -- and at BitLaunch? 
23 A. Yes. 


24 Q. And were you able to trace the Andrea Neumann —-- the 


25 Andrea Neumann Namecheap account using Bitcoin tracing? 
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ih MR. NEMTSEV: Objection. 


2 ‘ I wasn't personally, but an expert did, yes. 


3 ‘ Is that Vincent Kenney? 
4 < Yes. 


5 : And he's going to be testifying in this case, correct? 


6 : Yes. 


7 : And through that tracing, what company did that Bitcoin 


8 transaction come back to via IP addresses? 


9 MR. NEMTSEV: Objection. 


12:54 10 THE COURT: Sustained. Hearsay. 
11 OQ. Well, you were asked some -- the Andrea Neumann account 
12 was —-— the Andrea Neumann account -- withdrawn. 


13 The various Namecheap accounts, they were all registered 


14 with what kind of an email address? 


15 A. inbox.lv. 


16 Q. The Wan Connie account was registered with what kind of 
A} email address? 


18 . inbox.lv. 


19 : What IP address was used to access the Wan Connie account? 


12:54 20 : The M-13 89 IP address. 


21 : You were asked some questions about when Mr. Ermakov was 


22 added to Mr. Klyushin's iCloud account when you first found 


23 evidence of him in the iCloud account? 
24 A. 


25 Q. When did they go helicopter skiing together -- 
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1 MR. NEMTSEV: Objection. 


2 ‘ for Mr. Ermakov's birthday? 
3 THE COURT: Overruled. 


4 ‘ In April of 2018, on his birthday -- Ermakov's birthday. 


££ 


5 Q. You were asked some questions about whether you found 


6 pictures of Mr. Sladkov and Mr. Klyushin together. 


7 Do you recall that? 
8 A. Could you repeat the question? 
9 Ors You were asked some questions about whether you found 


12:55 10 photographs of Mr. Sladkov in the same photograph with 


1] Mr. Klyushin. 


12 Do you recall that? 


14 ‘ What did you find with regard to Mr. Klyushin on 


LS . Sladkov's iCloud account? 
16 : The product slide deck in September of 2019 —-- 
Af : That was the LAVR product? 


18 : Yes. 


19 : And you found it in September? 
12:55 20 : September. 

21 . 2019? 

22 Correct, September 4th. 


23 é When was it publicly announced? 


24 : It was the following year, if I recall. 


25 : What else did you find in Mr. Sladkov's iCloud account? 
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1. A. The M-13 chat application was identified. 
2 Q. And who else had the M-13 chat application in their iCloud 
3 accounts? 


4 ‘ Nikolai Rumiantcev and Vladislav Klyushin. 


5 ‘ And who owns M-13? 


6 : Vladislav Klyushin. 


7 : What else did you find in Mr. Sladkov's iCloud account? 


8 : Reference to the trading activity in Kohl's. 


9 : We'll come back to that in a moment. 


12:56 10 Did you find photographs of Mr. Klyushin's yacht? 


11 : Yes. 
12 : One photograph or more than one? 


13 : More than one. 


14 ‘ Did you find photographs taken on Mr. Klyushin's vacation 
LS to the Maldives? 


16 A. 


17 . NEMTSEV: Objection. 


18 : With respect to the Kohl's -—- 


19 THE COURT: You're going a little too fast for me. 


12:56 20 MR. FRANK: I'll ask it again more slowly, Your Honor. 


21 I'm trying to get done by 1:00. 


22 Q. Did you find photographs in Mr. Sladkov's iCloud account 


23 that Mr. Klyushin took on a vacation to the Maldives? 


24 MR. NEMTSEV: Objection. 


25 


12:57 10 


12:57 20 


21 


22 


23 


24 


25 
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THE COURT: What date? 


THE WITNESS: The date was surrounding the time that 


the vacation was occurring. It was January 2nd and 3rd of a 


particular year. f could refresh my recollection. 


MR. FRANK: I don't have that document right 


You don't remember the exact date; is that right? 


Correct. 


But they were Mr. Klyushin's photographs? 


Correct. 


Did you find photographs of the ski trip that Mr. Ermakov 


with Mr. Klyushin for his birthday? 


MR. NEMTSEV: Objection. 


COURT: Overruled. 
Yes. 
Those were in Mr. Sladkov's account as well? 


They were. 


Did you find a contact card for Mr. Ermakov? 


THE COURT: Where? 


In Mr. Sladkov's iCloud account. 


MR. FRANK: Could we have 171A, please. 


What is the date listed at the bottom of —- oh, 


is the contact card for Mr. Sladkov? 


And whose iCloud account was this in? 
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al : This was in Ivan Ermakov's account. 


2 : And what's the date that Mr. Sladkov's contact card was in 


3 . Ermakov's iCloud account? 


4 : November 16th, 2016. 


5 : You just referenced a moment ago a photograph of trading 


6 in the stock of Kohl's. 


7 Do you recall that? 
8 A. 


9 Q. And where did you find that photograph of trading in the 


12:58 10 stock of Kohl's? 


11 : That was in Sladkov's Apple account. 


12 : And how did it get there? 


13 : It was transmitted between Ivan Ermakov Igor Sladkov. 
14 : Who traded in Kohl's? 


15 . Vladislav Klyushin. 


16 : You were asked some questions about the Threema chat. 


17 Do you recall those questions? 


18 : Yes. 


19 Q. And you were asked whether Mr. Klyushin would have -—- was 


12:59 20 part of the Threema chat before he joined it or whether he 


21 would have seen it. 


22 Do you recall a question along those lines? 
23 : Yes. 
24 MR. FRANK: Could we have Exhibit 46, please. And 


25 could you go, please, to line 2276. 
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1 ©. Could you read from 2276 to 2279, identifying the speaker. 


2 A. Nikolai Rumiantcev, in response to Ivan Ermakov, saying, 


3 "This is my" -—- 


4 Q. I'm sorry. Actually, could you go back one line to 2275. 


bs A. Yes. Nikolai Rumiantcev, "Add Vlad to the chat." Nikolai 


6 Rumiantcev, in response to Ivan Ermakov, saying, "This is my 


7 colleague. He is completely on top with the subject. You can 


8 trust him as you trust me. And if you want, you can check with 
9 Viad." 


01:00 10 Rumiantcev's response, "Should all issues be addressed 


11 there?" In response to Nikolai Rumiantcev saying "Add Vlad to 


12 the chat," Ermakov responds, "Do you think he needs that?" 


13 Rumiantcev replies, "Yes. Quite often we need to explain him 


14 something that we have already discussed in the chat. But this 


LS way, he will be reading it on his own." 


16 Q. Thank you, Special Agent. 
A} You were also asked some questions about a photograph of a 


18 Reuters article regarding a Ukrainian hacker engaging in 


19 insider trading. 


01:00 20 Do you recall those questions? 
21 : Yes. 


22 MR. FRANK: Ms. Lewis, could we have Exhibit 34 in 


23 evidence, please. 


24 THE COURT: How much longer do you have? 


25 MR. FRANK: I'm wrapping up, Your Honor. 
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1 ‘ This is that photograph? 
2 ‘ Yes. 


3 : And this photograph in Mr. Klyushin's iCloud account was 


4 from August of 2018, correct? 
5 A. 2018, yes. 


6 Q. And this article, "Ukrainian hacker gets prison in U.S. 


7 insider trading case," was —-— 
8 THE COURT: Remember, this has nothing to do with this 
9 case. This is just a clip. 

01:01 10 Q. This photograph that Mr. Klyushin saved to his iCloud 

Li account was from August of 2018, correct? 

12 A. Yes. 


13 Q. And the article is in a plastic protective sleeve. 


14 Do you see that? 

15 : Yes. 

16 : And you located that article, correct? 
17 ‘ Yes. 


18 MR. FRANK: Could we have Exhibit 150 on the right, 


19 please. 
01:01 20 Q. And this is that article, correct? 


21 A. It is. 


22 MR. FRANK: And, Ms. Lewis, if you could enlarge it so 


23 we could see the date at the top. 


24 O. What is the date of the article? 


25 . May 22nd, 2017. 


01:02 10 


01:02 20 


21 


22 


23 


24 


25 
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Klyushin took a photograph of it in August of 2018 


in a protective plastic sleeve? 


A. Yes, over a year later. 


Q. Could you read the first sentence of the article? 


MR. 


NEMTS 


THE COURT: 


EV: 


Objection, Your Honor. 


Sustained. Let's finish. 


or The article is about insider trader based on 


yet—-to-be-published corporate news releases? 


MR. 


NEMTS 


COURT: 


FRANK: 


COURT: 


EV: 


Objection. 


Sustained. 


I'm wrapping up, Your Honor. 


Move on. 


the article about, Special Agent? 


MR. 


THE 


NEMTS 


COURT 


EV: 


Objection. 


Generally, what's the topic? 


A. It's about trading -- hackers having access to 


preannouncement information. 


THE COURT: 


MR. 


FRANK 


Thank you. What's the next question? 


No further questions. 
Okay. So do you have any -- 
Maybe a brief follow-up. 


What does "brief" mean? 


MR. 


THE 


tomorrow and 


Five minutes, maybe less. 


No. It's a long day. I'll see you 


I'll see counsel at sidebar for a second. 
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1 See you tomorrow morning. Thank you. 


2 THE CLERK: All rise. 


3 (Jury exits.) 


4 (SIDEBAR CONFERENCE AS FOLLOWS: 


5 THE COURT: Five or ten more minutes, right? 


6 MR. NEMTSEV: Yes. 


7 THE COURT: And that woman whose name is 


8 MR. FRANK: Ms. Shah. 


9 THE COURT: Ms. Shah. Then who? 


01:03 10 MR. FERNICH: Ms. Yanochko. 


11 THE COURT: A summary witness. How long does she 


13 MR. KOSTO: alf an hour on direct, at most. 


14 THE COURT: ow long? 


15 MR. NEMTSEV: Five, ten minutes. 


16 THE COURT: Okay. We are now in the vicinity of still 


1] around 10:00. 


18 MR. KOSTO: Then Mr. Uitto, U-i-t-t-o, forensic 


19 examiner from the FBI, with the computers. 


01:04 20 THE COURT: How long is he? 


21 MR. FERNICH: Again, about 35 minutes or so on direct. 


22 THE COURT: He's a 702 witness. He's been disclosed? 


23 MR. FERNICH: Yes, he has. 


24 THE COURT: So now we're pulling into, let's say, 


25 noon. Cross? 


01:04 10 


01:05 20 


21 


22 


23 


24 


25 
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THE 
that right? 
MR. 
THE 
right? 
MR. 
on our list, 
testifies. 
THE 
Wednesday? 


MR. 


15 minutes. 


EV: 


1B Then —-- 


And then Mr. Kenney, the Bitcoin expert. 


How long is he? 
about 30 minutes. 


Again, Maybe a little 


That pretty much finishes off the day. 


KOSTO: 


think that's fair, Your Honor. 


COURT: 


Then you have the statistics man. 


Or is there someone else? 


KOSTO: There's one other witness from StackPath 


Your Honor. We'll make a decision after Ms. Shah 


COURT: Let me just say, you're likely to rest on 


KOSTO: On Wednesday, yes. 


So you're going to start your case then? 


EV: Yes, ma'am. 


So who do you have first? 


MR. 


expert witness in computer forensics, 


second witness, 


and trading strategies, 


disclosed in 


NE Two witnesses. First is Mr. 


EV: Robert, an 


IT, et cetera; and the 


Mr. Tawil, who will testify regarding trading 


all the subject matter that's been 


his expert disclosure. 
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1 THE COURT: So you're likely to be done Thursday, 


3 MR. NEMTSEV: Yes. 


4 THE COURT: Okay. So -—- and I understand you're super 


5 busy and it's really stressful being on trial, so I'm not -—- 


6 when will I be able to get objections to the jury instructions? 


7 I think there's some chance this would go to the jury on 


8 Friday. More likely on Monday. But it's soon, depending on 


9 how things go. 


01:05 10 MR. FERNICH: Do you want written objections to 


11 instructions, or we do that at the conference? 


12 THE COURT: I've done it both ways. Honestly, I don't 


13 require a brief. I don't require -—- I sometimes do -- if you 


14 have suggestions, like handwritten over the top let me b 


£ 


15 quite clear. I've given the first part of that jury 


16 instruction, what's reasonable doubt, I've given that 


17 instruction maybe 30 years. So I'm not likely to change a lot 


18 there. And the end is just jury deliberations. It's the 


19 middle part I'm most interested in. Some of them are new 


01:06 20 instructions for me. And -—- in particular, I didn't like 


21 either of your instructions on venue. So I went back actually 


22 to eBay, an opinion I wrote, and tried to go back to some of 


23 the case law on it. So that's what I focused on because 


Sa 


24 neither of you sort of gave me that. And —-- 


25 MR. FERNICH: So I'll have a look through the 
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] instructions tonight, and I'll let you know first thing in the 


2 morning if I need to write anything. And if I do, I'll have it 


3 in by the end of the day. 


4 THE COURT: Okay. And maybe a supplemental 


5 instruction. I don't think either of you -—- maybe I'm wrong -—- 


6 submitted one on expert testimony. Maybe that's something I 


a should add. Those are the generic ones. But what I've been 


8 giving is essentially boilerplate, for want of a better word, 


9 pattern jury instructions kinds of things from wire fraud, 


01:07 10 securities fraud, computer fraud, and conspiracy, primarily, 


11 and some of it -- it gets wordy. 


12 MR. FERNICH: Mm-hmm. 


13 THE COURT: So, you know, I'm happy to be instructed 


14 on that, but when in doubt, I'll stick with the pattern 


iS) instructions. 


16 MR. FERNICH: Mm-—-hmm. 


A} COURT: Have you looked at them at all? 


18 MR. KOSTO: I expect we'll have a short submission, 


19 Your Honor, with a couple of requests for extra definitions and 


01:07 20 a request to strike some surplusage, but not much. 


21 THE COURT: Okay. All right. So when you're thinking 


22 about a charge and a conference Mem, how much time do we 
23 have Wednesday afternoon? 


24 THE CLERK: We do not have anything scheduled right 


25 : I think you're good. I have to look at your personal 


01:08 10 


01:08 20 


2] 
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We'll have to take a look at that. 


will be Wednesday afternoon. Ideally, you'll have lunch, 


you don't want to starve to death, 


so you can have the rest of the day. I can't remember if 


have anything. 
THE CLI 
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But it 


since 


and do something around 2:00 


don't have it up yet. 


And I'm assuming, just for purposes of 


prepping, that 
Friday. 
FRANK: 
COURT: 
MR. FRANK: 


THE COURT: 


earliest we would go to the jury would be 


So closings, potentially, on Friday. 
What? 


So closings, potentially, on Friday. 


Potentially. It may also be Monday. 


the reason I do that is a juror asked about a doctor's 


appointment. It's 


really right on the edge. I think the 


closing wouldn't be any later than Monday, right, at this 


point? 
MR. FRANK: 
THE COURT: 


sick or something. 


22 


23 


24 


25 


Yes, Your Honor. 


Unless there's a snowstorm or someone gets 


I think I'd say to that juror -—- what 


say to her? She wants the doctor's appointment Monday 


afternoon. It's right on the edge. 


MR. KOSTO: 


THE COURT: 


Can she do it after 2:00? 


T'll just say to her or him, if 


do I 
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1 urgent, we'll respect it. If it can be -—- 


2 THE CLERK: Juror No. 1. 


3 THE COURT: moved 


4 MR. FRANK: I think we're going to wrap up on 
bs Thursday, Your Honor, based on what Mr. Nemtsev is telling me. 
6 THE COURT: That's both sides? 


7 MR. FRANK: Yes. I mean, not closings, but witnesses. 


8 THE COURT: I'ma little reluctant to say that, 


9 because, of course, you never know what happens -—- and, of 


01:09 10 course, Mr. Klyushin always has the right, if he wants to -- so 


1] I'm not going to give a definitive time, but that's useful. 


12 I'll say it's right on the boundary. Okay. That's good to 


13 know. 


14 THE CLERK: Wednesday looks okay for you, Judge, right 


is) now. Yeah, there's nothing on. We had a case on, but we moved 
16 it. So it's open. 


17 MR. KOSTO: Should we plan for 2:00 on Wednesday? 


18 THE COURT: I think that's currently what I would 


19 suggest. And I'm planning on —- unless there's something 


01:09 20 massive, that it's probably going to be no longer than two 


21 hours, and my guess is an hour. 


22 MR. FERNICH: I don't think it will be very long. 


23 THE COURT: Yes. That's right. 


24 Now, Mr. Frank, I used to think I was a fast talker 


25 IT met you. 
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al MR. FRANK: I was trying to just get done by 


2 THE COURT: You were so slow at the start of 


3 testimony, and then that redirect went 


4 MR. FRANK: I'm sorry, Your Honor, I was trying to get 


5 done by 1:00. 


6 THE COURT: I understand. I'm not faulting you. But 


7 it was a little hard to follow, so I'm going to take a look at 
8 the transcript. 


9 MR. FRANK: I'm happy to have another go at it. 


01:10 10 THE COURT: I'm still wanting a -- I'm assuming there 


11 will be a motion for directed verdict which will spell out the 


12 grounds and an opp which will spell out the grounds. If 104 


13 stops at the VPN -—- you're saying no, it doesn't, but I lost 


14 the stream after that. 


15 MR. FRANK: 104 is part of the conspiracy, Your Honor. 


16 The conspirators used the same tactics -- 


A} THE COURT: Excuse me. I just want to understand --— 


18 MR. FRANK: We'll explain it. 


19 COURT: where the numbers track back to. 


01:10 20 MR. FRANK: We'll explain it, Your Honor. 


21 THE COURT: You tracked back the 89 one and the 119 
22 “ 104 stopped, according to the agent, with the VPN. 


23 MR. FRANK: Right. 


24 THE COURT: I just need to understand the basis where 


25 you think you're going to -—- 


Case 1:21-cr-10104-PBS Document 214 Filed 02/21/23 Page 160 of 161 


Mr. 


So 


6-160 


MR. KOSTO: Your Honor, what I think we'll —- 


THE COURT: —- meet both the elements and the venue. 


I'm sure you're all going to explain it to me with clarity, but 


Frank went at the end so fast I wasn't sure I caught it. 


I'm just flagging that. 


MR. KOSTO: Thank you, Your Honor. 


(Court exits.) 


(Proceedings adjourned at 1:11 p.m.) 
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